SQL Injection Flaws Expose AVideo Data and Enable OpenSTAManager RCE

Two newly disclosed SQL injection vulnerabilities affect WWBN AVideo Live Schedule Reminder and the OpenSTAManager Aggiornamenti module, exposing organizations to severe database compromise. CVE-2026-33651 is a blind SQL injection issue in AVideo rated CVSS 8.1 that can let attackers exfiltrate the full database, including email addresses, personal information, and password hashes, while also modifying or deleting records through injected UPDATE or DELETE statements. Repeated time-based exploitation attempts could also degrade service performance by exhausting server connection pools.

CVE-2026-35168 affects OpenSTAManager and allows an authenticated attacker to execute arbitrary SQL with the privileges of the configured database user, undermining confidentiality, integrity, and availability. In MySQL or MariaDB deployments with broad database permissions, the flaw can enable schema changes, stored procedure tampering, and theft of sensitive financial data; where the database account has the FILE privilege, attackers can escalate from database access to remote code execution on the application server by writing arbitrary files to the host filesystem.