CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels
Unauthenticated attackers can exploit SQL injection in the channels API to infer password hashes and disclose database schema details.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85155?
CVE-2026-85155 is a high-severity SQL injection vulnerability in WWBN AVideo, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
Weakness: CWE-89
Which versions are affected by CVE-2026-85155?
How do I fix CVE-2026-85155?
No fix has been published for CVE-2026-85155 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-85155 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85155 exists.
Sources
Also known as GHSA-pmmj-6425-gpgh, GHSA-vc5p-99m7-gx5v.