CVE-2026-84208: AVideo User_Location Plugin Unauthenticated SQL Injection
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the UserLocation plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote, unauthenticated attacker can exploit the affected endpoints. No account, privileges, or user interaction are required.
Which inputs and endpoints are affected?
The affected User_Location plugin endpoints are regions.json.php and cities.json.php. The vulnerable GET parameters are country and region, respectively.
What data could be exposed?
An attacker can use UNION-based SQL injection to read arbitrary database contents, including password hashes and other sensitive data.
How can I determine whether my deployment is affected?
Deployments using the AVideo User_Location plugin are affected if they run AVideo version 29.0 or earlier. Check whether regions.json.php and cities.json.php are reachable and whether the plugin is installed.