Home / Vulnerability Intelligence / CVE-2026-34374

CVE-2026-34374 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: March 30, 2026

WWBN AVideo - SQL Injection

Published: March 27, 2026Updated: March 30, 2026Remote Exploitable

Overview

WWBN AVideo <= 26.0 contains a SQL injection caused by unparameterized interpolation of stream key in Live_schedule::keyExists(), letting attackers execute arbitrary SQL commands during RTMP publish authentication, exploit requires crafted stream key.

Severity & Score

Severity: Critical

CVSS Score: 9.1

EPSS Score: 3.5%(Probability of exploitation in next 30 days)

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version once a patch is available.

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 28, 2026

🚨 CRITICAL: CVE-2026-34374 in WWBN AVideo ≤26.0 allows unauthenticated SQL injection via stream key lookup during RTMP authentication. No patch out yet. Restrict access, use WAFs, & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-34374-cwe-89-improper-neutralization-of-s-171f2208 #OffSeq #SQLInjection #WWBN #VideoSecurity

View original post

Related Resources

Details

CVE ID: CVE-2026-34374
Severity: Critical
CVSS Score: 9.1
Type: sql_injection
Status: unconfirmed
EPSS: 3.5%
Social Posts: 1

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score

3.5%Probability of exploitation in the next 30 days