Critical Vulnerabilities in AVideo: From SQL Injection to Remote Code Execution

**Executive Summary:** Security researchers disclosed two high-severity vulnerabilities in the AVideo open-source streaming platform: CVE-2026-28501 (unauthenticated SQL injection, CVSS 9.8) that can enable database exfiltration and credential theft, and CVE-2026-28502 (authenticated plugin upload RCE) that permits full system compromise via malicious ZIP uploads; users are urged to upgrade to AVideo v23+ or apply mitigations such as disabling plugin imports and hardening web server execution permissions.