Cross site scripting

An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known b...

CVE-2019-12386

An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known b...

Sql injection

An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches even guest users can dump any data contained in the database sessions, hashed passwords, etc.. This may lead to a full compromise of...

UBUNTU-CVE-2019-12386

An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known b...

CVE-2019-12386

CVE-2019-12386 affects Ampache (up to version 3.9.1 per initial entry) via a stored XSS in localplay.php (LocalPlay “add instance” function). The injected script is reflected in the instances menu and can be abused to force an admin to create a new privileged user. Numerous advisories (Debian DLA...

CVE-2019-12386

An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known b...

CVE-2019-12385

An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches even guest users can dump any data contained in the database sessions, hashed passwords, etc.. This may lead to a full compromise of...

CVE-2019-12385

CVE-2019-12385 affects Ampache up to version 3.9.1. A SQL Injection in the search engine (lib/class/search.class.php) allows any user performing searches (including guests) to dump data from the database (sessions, hashed passwords, etc.), which can lead to full admin compromise when combined wit...

CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

UBUNTU-CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

Code injection

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

CVE-2017-18375

Ampache 3.8.3 is affected by a vulnerability that allows PHP object instantiation via the files democratic.ajax.php and democratic.class.php. The connected sources consistently state this issue but do not provide technical specifics such as vulnerable functions, versions beyond 3.8.3, root cause ...

CVE-2017-18375

Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php...

Multiple Reflective Cross-Site Scripting Vulnerabilities in Ampache

Ampache is a WEB-based audio/video streaming software and file manager. Multiple reflective cross-site scripting vulnerabilities exist in Ampache. An attacker can construct XSS statements and perform pop-up box operations to obtain user cookies and other information...

Ampache 3.8.6 Cross Site Scripting

Multiple Reflected Cross-site Scripting Vulnerabilities in Ampache 3.8.6 Information -------------------- Advisory by Netsparker Name: Multiple Reflected Cross-site Scripting in Ampache 3.8.6 Affected Software: Ampache Affected Versions: 3.8.6 Homepage: http://ampache.org Vulnerability: Reflected...

Ampache 3.8.6 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Multiple Reflected Cross-site Scripting Vulnerabilities in Ampache 3.8.6 Information -------------------- Advisory by Netsparker Name: Multiple Reflected Cross-site Scripting in Ampache 3.8.6 Affected Software: Ampache Affected Versions: 3.8.6...

Ampache 3.8.2 Cross Site Scripting

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AMPACHE-v3.8.2-XSS.txt + ISR: ApparitionSec Vendor: ========== ampache.org Product: ============== ampache v3.8.2 A web based audio/video streaming application and file...

Ampache 3.4.3 'login.php' Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/37417/info Ampache is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to...