46 matches found
Bazarr < 1.4.3 - Arbitrary File Read
Bazarr 1.4.3 and earlier versions have a arbitrary file read vulnerability. id: CVE-2024-40348 info: name: Bazarr Bazarr" - 'content="Bazarr' - "window.Bazarr" condition: or internal: true - method: GET path: - "BaseURL/api/swaggerui/static/../../../../../../../../../../../../../../../../etc/pass...
CVE-2026-61826
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...
CVE-2026-61826 Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...
CVE-2026-61826
In versions prior to 1.5.7-beta.14 , Bazarr is vulnerable to unauthorized configuration tampering and Server-Side Request Forgery (SSRF) . The api_ns_plex namespace in bazarr/api/plex/oauth.py fails to include the @authenticate decorator, allowing anonymous callers to bypass API key requirements....
CVE-2026-61826 Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...
EUVD-2026-114256
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...
CVE-2026-61826 Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...
CVE-2026-61826: morpheus65535 bazarr: Bazarr is a companion application to Sonarr and Radarr
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...
Bazarr < 1.4.3 - Arbitrary File Read Detection
Bazarr 1.4.3 and earlier versions have a arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Bazarr 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bazarr 1.4.3 - Arbitrary Fi...
Bazarr Login - Detect
Bazarr login page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Bazarr login page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bazarr Login - Detect', 'description': 'Bazarr login page w...
CVE-2023-50266
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...
CVE-2023-50265
Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1...
EUVD-2023-55076
Malicious code in bioql PyPI...
EUVD-2023-55078
Malicious code in bioql PyPI...
EUVD-2023-55077
Malicious code in bioql PyPI...
CVE-2023-50264
Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system...
Bazarr Arbitrary File Read Vulnerability
Bazarr is a companion app to Sonarr and Radarr that manages and downloads subtitles to your specifications. Bazarr suffers from an arbitrary file read vulnerability due to an issue in component /api/swaggerui/static in Bazaar v1.4.3 that allows an unauthenticated attacker to perform directory...
Bazarr security vulnerabilities
Bazarr is a companion app to Sonarr and Radarr that manages and downloads subtitles to your specifications. Bazarr suffers from an arbitrary file read vulnerability due to an issue in component /api/swaggerui/static in Bazaar v1.4.3 that allows an unauthenticated attacker to perform directory...
CVE-2023-50266
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get without any sanitization, which leads to a blind server-side request forgery SSRF. This issue allo...
CVE-2023-50264
Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the sendfile function, which leads to an arbitrary file read on the system...