QNAP Music Station < 5.4.0 - Authentication Bypass

An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Music Station 5.4.0 and later id:...

Joomla! Component Music Manager - Local File Inclusion

A directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the cid parameter to album.html. id: CVE-2010-2857 info: name: Joomla! Component Music Manager - Local Fil...

Lyrion Music Server <= 9.2.0 - Cross-Site Scripting

Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

エグゼクティブサマリー macOS のミュージックおよび TV アプリは、安全でないリネーム処理を実行しており、その結果としてユーザーの TCC.db に対する完全な制御を得る FDA フルディスクアクセス を引き起こします。 このバグは各アプリごとに別々のチケットで報告しています。該当する場合はマージしていただいて構いません。 根本的な問題は、これらのアプリが FDA を持っているにもかかわらず、ファイル操作をサニタイズしていないことです。 エクスプロイトの説明 ミュージックと TV はこの点においてほぼ同一であり、パスが異なるだけです。以降はミュージックを例として説明します。TV...

DC30-Badge-Challenge-Writeup

DC30-Badge-Challenge-Writeup 目录 介绍 挑战第 1 部分：收集音符 挑战第 2 部分：呼叫 YИИEႱ 挑战第 2A 部分：Alice 挑战第 2B 部分：Bob 挑战第 2C 部分：Carol 挑战第 2D 部分：Dan 挑战第 2E 部分：Eve 挑战第 2F 部分：Trevor 挑战第 3 部分：最终线索 如果我错过了大会上的电话怎么办？ 后记 介绍 大家好！我是 Pete，也叫 Kybr，这是我为 DEF CON 30 徽章挑战赛写的解题报告。...

CVE-2026-82304

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82304

Music Store is a WordPress eCommerce plugin that, in versions before 1.4.5 , is vulnerable to an unauthenticated SQL injection via the paypal-data handler. The root cause is unsanitised and unescaped user input passed directly into a SQL statement. The CVSS 3.1 base score is 8.6 (HIGH) , reflecti...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

EUVD-2026-71856

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

PT-2026-86340

🚨 CVE-2026-82304 The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. 🎖@cveNotify...

CVE-2026-81289 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...

CVE-2026-78283

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

EUVD-2026-66941

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283

CVE-2026-78283 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Music Player for WooCommerce , affecting versions ≤ 1.8.9 . The flaw was discovered by daroo and is scored CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a ...

WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Music Player for WooCommerce versions = 1.8.9...

CVE-2026-73662

A flaw was found in the FreePBX Music on Hold module. An authenticated administrator can exploit dangerous command-line options when configuring media players, such as /usr/bin/mpg123. This allows the administrator to execute arbitrary commands as the asterisk service user by writing files, openi...

CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73662

CVE-2026-73662 affects FreePBX Music on Hold module (versions 17.0.1–17.0.7). The vulnerability arises from validateCustomConfiguration() in Music.class.php allowing dangerous command-line options to mpg123 and other allowed players, enabling an authenticated administrator to write files, open co...