SQL injection in AVideo - CVE-2026-84208
Published: November 11, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU165927
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84208
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read arbitrary database contents, including password hashes, session tokens, and personal information.
The vulnerability exists due to unescaped interpolation of the country and region GET parameters into SQL queries in AVideo's User_Location plugin when its ip2location_db3 table is installed. A remote attacker can send crafted GET requests to regions.json.php or cities.json.php using UNION-based SQL injection, such as country=nonexistent' UNION SELECT password FROM users-- -, to extract sensitive database contents.
Affected software
AVideo
How to mitigate CVE-2026-84208
Install security update from vendor's website.
AVideo - update to 29.1.0