6 matches found
EUVD-2026-120558
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...
CVE-2026-125395
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...
CVE-2026-125395: ampache: Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to…
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...
CVE-2026-125395 Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...
CVE-2026-125395
Ampache versions before 8.4.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the LyricsView.php getLyrics() function and show_lyrics.inc.php , where song lyrics are not properly escaped. An attacker with upload rights can inject malicious HTML and scripts into th...
PT-2026-141218
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and show lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute...