CVE-2026-85155: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WWBN AVideo

The vulnerability in WWBN AVideo is an improper neutralization of special elements used in an SQL command (SQL injection) affecting the sort column parameter of the get.json.php endpoint with APIName=channels. Attackers do not require authentication to exploit this issue. By controlling the sort parameter, they can order results by arbitrary database columns, including sensitive user credential fields. This enables attackers to infer password hashes and recovery tokens and to cause SQL errors that disclose the full SQL query and database schema, increasing the risk of further exploitation. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows unauthenticated attackers to access sensitive information such as password hashes and recovery tokens by manipulating the SQL query ordering. Additionally, attackers can trigger SQL errors that reveal the full SQL query and database schema, potentially facilitating further attacks or data leakage. This compromises the confidentiality of user credentials and recovery information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the affected endpoint if possible and monitor for suspicious activity related to this vulnerability.