CVE-2026-33770: AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

The fixCleanTitle() static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $clean_title and $id into the query string without using prepared statements or parameterized queries. An attacker who can trigger category creation or renaming with a crafted title value can inject arbitrary SQL.