CVE-2026-84208: Wwbn Avideo

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.

Affected products

• Wwbn Avideo: up to and including 29.0

Published 2026-09-01. Last modified 2026-09-08.