CVE-2026-84208
Received Received - Intake

AVideo Unauthenticated SQL Injection via User_Location Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84208
EUVD
EUVD-2026-69717

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
avideo avideo to 29.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AVideo version 29.0 and earlier has an unauthenticated SQL injection flaw in the User_Location plugin. Attackers can exploit this by sending crafted GET requests to regions.json.php or cities.json.php endpoints, manipulating the country and region parameters to inject malicious SQL queries. This allows reading sensitive database contents like password hashes without authentication.

Detection Guidance

Check if the AVideo application is running and accessible. Inspect the User_Location plugin's regions.json.php and cities.json.php endpoints for unauthenticated access. Test GET parameters country and region with SQL injection payloads like ' OR 1=1 -- to see if database contents are exposed.

Impact Analysis

An attacker could extract sensitive data such as user credentials, personal information, or other confidential records from the database. This could lead to unauthorized access to accounts, data breaches, or further exploitation of the system depending on the exposed data.

Compliance Impact

This vulnerability could result in unauthorized access to personal data, violating GDPR's data protection principles and potentially triggering breach notification requirements. For HIPAA, exposure of protected health information could lead to compliance violations and penalties.

Mitigation Strategies

Update AVideo to the latest version beyond 29.0. If an update is unavailable, disable the User_Location plugin immediately. Implement input validation and use prepared statements for all SQL queries involving country and region parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84208. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart