PYSEC-2026-1277 copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

Summary An unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. Details Multimedia metadata is rendered in the web-app without sanitization. This can be exploited in two way...

xiaomusic contains an unauthenticated path traversal vulnerability

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/filepath:path endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check. Attackers can request files from...

CVE-2026-37340

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/editmusic.php...

CVE-2026-37336

The SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection due to improper neutralization of special elements used in an SQL command within the /music/view_music.php file. This flaw allows an attacker to insert malicious SQL statements into entry fields for executi...

PT-2026-33326

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Music Cloud Community System version 1.0 Description An issue exists in the file '/music/view music.php' that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for...

CVE-2026-37340

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/editmusic.php...

CVE-2026-37340

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/editmusic.php...

CVE-2026-37336

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/viewmusic.php...

openSUSE 16 Security Update : fluidsynth (openSUSE-SU-2026:20291-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20291-1 advisory. - CVE-2025-56225: NULL pointer deference when loading and invalid MIDI file bsc1256435. Tenable has extracted the preceding description block directly...

The vulnerability of the Music File Upload Service in D-Link DCS-700L microprogrammed software cameras allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Music File Upload Service in D-Link DCS-700L microprogrammed software cameras stems from an incorrect limit on the path to the restricted catalog during the processing of the UploadMusic parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized...

CVE-2026-1532 D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal

A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. The manipulation of the argument UploadMusic leads to path traversal. The attack can only be initiated within the loc...

EUVD-2026-4849

A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. The manipulation of the argument UploadMusic leads to path traversal. The attack can only be initiated within the loc...

CVE-2026-1532

CVE-2026-1532 affects D-Link DCS-700L v1.03.09. The vulnerability is in the Music File Upload Service, specifically the uploadmusic function in /setUploadMusic, where manipulating the UploadMusic argument can trigger path traversal. Exploitation appears feasible within a local network, and public...

CVE-2026-1532: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. The manipulation of the argument UploadMusic leads to path traversal. The attack can only be initiated within the loc...

PT-2026-5786

Уязвимость службы Music File Upload Service микропрограммного обеспечения IP-камер D-Link DCS-700L связана с неверным ограничением имени пути к каталогу с ограниченным доступом при обработке параметра UploadMusic. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить...

Astra Linux – Vulnerability in fluidsynth

Fluidsynth-2.4.6 and earlier versions are vulnerable to null pointer dereferencing in the fluidsynthmonopoly.c file, which can occur when loading an invalid MIDI file...

SUSE CVE-2025-56225

fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluidsynthmonopoly.c, that can be triggered when loading an invalid midi file...

Linux Distros Unpatched Vulnerability : CVE-2017-11661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The WMSetupMidiEvent function in internalmidi.c:2318 in WildMIDI 0.4.2 can cause a denial of service invalid memory read and application crash via a crafted mid...

CVE-2011-10023

MJM QuickPlayer likely now referred to as MJM Player version 2010 contains a stack-based buffer overflow vulnerability triggered by opening a malicious .s3m music file. The flaw occurs due to improper bounds checking in the file parser, allowing an attacker to overwrite memory and execute arbitra...

Arbitrary File Upload

Overview MoneyPrinterTurbo is a Simply provide a topic or keyword for a video, and it will automatically generate the video copy, video materials, video subtitles, and video background music before synthesizing a high-definition short video.. Affected versions of this package are vulnerable to...