CVE-2026-33770 Authenticated SQL Injection in AVideo Category Management

CVE-2026-33770 is a high-severity vulnerability. AttackerView checks AVideo sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-33770?

Detects AVideo installations at version 26.0 or earlier. The fixCleanTitle() static method in objects/category.php constructs a SQL SELECT query by directly interpolating $clean_title and $id without parameterized queries. An authenticated user with category-creation privileges can inject arbitrary SQL to extract database contents including admin credentials and user PII via UNION injection. Update AVideo to a version after commit 994cc2b.