CVE-2026-84208

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description An unauthenticated SQL injection exists in the User Location plugin. The endpoints 'regions.json.php' and 'cities.json.php' fail to properly escape or bind the country and region GET parameters before using them in SQL queries. This allows attackers to perform UNION-based SQL injection, a technique used to combine the results of the original query with results from an injected query, to retrieve arbitrary database information such as password hashes and other sensitive data.

Recommendations Update AVideo to a version later than 29.0. Restrict access to the 'regions.json.php' and 'cities.json.php' endpoints within the User Location plugin to minimize the risk of exploitation.