CVE-2026-84208

AVideo through version 29.0 contains an unauthenticated, UNION-based SQL injection in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are inserted directly into SQL queries without escaping or prepared-statement binding, so a single crafted HTTP GET request triggers the flaw. An unauthenticated attacker can exploit the injection to read arbitrary database contents, including user password hashes and other sensitive data stored in the AVideo database. Any deployment of AVideo up to and including version 29.0 that exposes these plugin endpoints over the network is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade AVideo to a release newer than 29.0 or apply the vendor patch when available (no fixed version number is specified in the available data). As interim mitigation, disable the User_Location plugin if it is not needed, or restrict access to /plugin/User_Location/regions.json.php and cities.json.php via WAF rules or allowlisting and validate/parameterize the country and region parameters. Because password hashes are readable through the injection, review access logs for anomalous requests to these endpoints and consider credential rotation and a database audit on exposed servers.