CVE-2026-33485

{"id": "CVE-2026-33485", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-03-23T15:16:34.887", "references": [{"url": "https://github.com/WWBN/AVideo/commit/af59eade82de645b20183cc3d74467a7eac76549", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8p58-35c3-ccxx", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessible without authentication. The `$_POST['name']` parameter (stream key) is interpolated directly into SQL queries in two locations \u2014 `LiveTransmitionHistory::getLatest()` and `LiveTransmition::keyExists()` \u2014 without parameterized binding or escaping. An unauthenticated attacker can exploit time-based blind SQL injection to extract all database contents including user password hashes, email addresses, and other sensitive data. Commit af59eade82de645b20183cc3d74467a7eac76549 contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, el callback RTMP 'on_publish' en 'plugin/Live/on_publish.php' es accesible sin autenticaci\u00f3n. El par\u00e1metro '$_POST['name']' (clave de transmisi\u00f3n) se interpola directamente en consultas SQL en dos ubicaciones \u2014 'LiveTransmitionHistory::getLatest()' y 'LiveTransmition::keyExists()' \u2014 sin enlace parametrizado ni escape. Un atacante no autenticado puede explotar una inyecci\u00f3n SQL ciega basada en tiempo para extraer todo el contenido de la base de datos, incluyendo hashes de contrase\u00f1as de usuarios, direcciones de correo electr\u00f3nico y otros datos sensibles. El commit af59eade82de645b20183cc3d74467a7eac76549 contiene un parche."}], "lastModified": "2026-03-24T18:35:45.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}