CVE-2026-85155 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances, especially those using it for user management or sensitive data, should assess exposure and prioritize remediation. This includes reviewing API usage, restricting access to the get.json.php endpoint, and implementing input validation and sanitization for API parameters. Additionally, defenders should monitor for suspicious API requests and database errors. AVideo instance administrators should verify and remediate this vulnerability to prevent potential unauthorized access to sensitive user data. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Platform and operator stakeholders should also be informed of the potential risks and necessary actions. The AVideo instance's exposure and review context should be assessed to determine the necessary course of action. The CVE description and source references indicate a SQL injection vulnerability in AVideo's get.json.php endpoint. The vulnerability allows unauthenticated attackers to infer password hash values and recovery tokens, and disclose the full query statement and database schema. Defenders should prioritize verifying and remediating this vulnerability, especially if AVideo is used for user management or sensitive data. The CVE record was published on 2026-09-03T13:06:22.210Z and has not been modified since then. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. The AVideo get.json.php endpoint with APIName=channels is vulnerable to SQL injection. Unauthenticated attackers can exploit this vulnerability to order results by arbitrary database columns, including users.password and users.recoverPass. This allows attackers to infer password hash values and recovery tokens. Additionally, attackers can trigger SQL errors that disclose the full query statement and database schema. The CVE description and source references indicate a SQL injection vulnerability in AVideo's get.json.php endpoint. The vulnerability allows unauthenticated

Why it matters

This SQL injection vulnerability in AVideo's get.json.php endpoint allows unauthenticated attackers to infer sensitive user data and disclose database schema. Defenders should prioritize verification and remediation, especially if AVideo is used for user management or sensitive data.

• Password hash inference and recovery token exposure
• Database schema disclosure through SQL errors
• Potential for unauthorized access to sensitive user data
• Need for input validation and sanitization to prevent exploitation

Technical summary

The AVideo get.json.php endpoint with APIName=channels is vulnerable to SQL injection. Unauthenticated attackers can exploit this vulnerability to order results by arbitrary database columns, including users.password and users.recoverPass. This allows attackers to infer password hash values and recovery tokens. Additionally, attackers can trigger SQL errors that disclose the full query statement and database schema.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially if AVideo is used for user management or sensitive data.

Recommended defensive actions

• Verify AVideo instance exposure and review API usage
• Restrict access to get.json.php endpoint
• Implement input validation and sanitization for API parameters
• Monitor for suspicious API requests and database errors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description and source references indicate a SQL injection vulnerability in AVideo's get.json.php endpoint. The vulnerability allows unauthenticated attackers to infer password hash values and recovery tokens, and disclose the full query statement and database schema.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.