CVE-2026-33770 is a SQL injection flaw in WWBN AVideo, an open source video platform. NVD scores it 9.8. The fixCleanTitle() method builds a query from the category title and ID without parameters. Update to a build that includes the fix. The advisory names the vulnerable method as fixCleanTitle in the category code.
What's affected
NVD says versions up to and including 26.0 are affected and points to commit 994cc2b3d802b819e07e6088338e8bf4e484aae4 as the patch. The GitHub advisory lists affected as below 26.0 and patched as 26.0 or later. The sources disagree on 26.0, so confirm the fix commit is in your build rather than relying on the number alone.
The advisory says an attacker who can create or rename a category with a crafted title can inject SQL. Its example describes an authenticated admin doing so.
How to check if you're exposed
Check your AVideo version in the admin panel and whether objects/category.php still concatenates the title and ID into the query. If you deploy from git:
git branch --contains 994cc2b3d802b819e07e6088338e8bf4e484aae4
An empty result means your checkout lacks the fix.
What to do now
- Update AVideo to a release that includes the fix commit.
- Limit category creation and editing to trusted admins.
- Review the database and category list for odd entries, and check logs for unusual queries.
- Back up before updating.
Why it matters
The record uses CWE-89, SQL injection. Values from users are inserted into a query string, so quotes in the value change the query. Prepared statements keep data separate from SQL and are the standard fix. The record is not marked as exploited in the wild and is not in CISA KEV.
SQL injection has a well understood fix. Use parameterized queries so that data and SQL stay separate, and validate IDs as integers before they reach a query. A static analysis scan can find string built queries across a codebase, which helps because the same pattern often appears in more than one file. After updating, search the project for other queries built by interpolating variables, and fix those too.
Quick check
Is 26.0 patched?
Sources conflict. Verify the fix commit is present in your build.
Sources
Last reviewed: 19 October 2026.
