239 matches found
CVE-2026-121427
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...
EUVD-2026-115959
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...
CVE-2026-121427 AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...
CVE-2026-121427 AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...
CVE-2026-121427 AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...
CVE-2026-121427
AzuraCast versions through 0.23.8 are vulnerable to a config injection flaw within the frontend_config.custom_config parameter during a PUT /station/{id}/profile/edit request. The system fails to strip this configuration from users who lack the Manage station broadcasting permission. Consequently...
PT-2026-136184
Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.9 Description An authenticated user with the Manage station profile permission can hijack the station's Shoutcast frontend. The issue occurs because the application fails to remove frontend config.custom config...
CVE-2026-121427: AzuraCast: AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users…
AzuraCast through 0.23.8 fails to remove frontendconfig.customconfig in PUT /station/id/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast scserv.conf file. An authenticated user with only the...
CVE-2026-100851
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...
CVE-2026-100851 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...
CVE-2026-100851
AzuraCast versions prior to 0.23.8 are vulnerable to a broken access control flaw in the GET /api/station/{id}/vue/profile endpoint. This vulnerability allows authenticated users possessing only View Station Page permissions to access sensitive information, specifically Icecast/Shoutcast admin, s...
CVE-2026-100851 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...
EUVD-2026-87837
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...
CVE-2026-100851: Exposure of Sensitive Information to an Unauthorized Actor
AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...
SHOUTcast Server Panel - Detect
SHOUTcast Server panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SHOUTcast Server panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SHOUTcast Server Panel - Detect', 'description':...
EUVD-2001-0209
Malware in sbrugna...
EUVD-2006-3004
Malware in sbrugna...
EUVD-2002-0196
Malware in sbrugna...