CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

QNAP Music Station < 5.4.0 - Authentication Bypass

An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Music Station 5.4.0 and later id:...

Lyrion Music Server <= 9.2.0 - Cross-Site Scripting

Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...

Joomla! Component Music Manager - Local File Inclusion

A directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the cid parameter to album.html. id: CVE-2010-2857 info: name: Joomla! Component Music Manager - Local Fil...

DC30-Badge-Challenge-Writeup

DC30-Badge-Challenge-Writeup Table of Contents Intro Challenge Part 1: Gathering Notes Challenge Part 2: Calling YИИEႱ Challenge Part 2A: Alice Challenge Part 2B: Bob Challenge Part 2C: Carol Challenge Part 2D: Dan Challenge Part 2E: Eve Challenge Part 2F: Trevor Challenge Part 3: The Final Threa...

CVE-2026-82304

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82304

Music Store is a WordPress eCommerce plugin that, in versions before 1.4.5 , is vulnerable to an unauthenticated SQL injection via the paypal-data handler. The root cause is unsanitised and unescaped user input passed directly into a SQL statement. The CVSS 3.1 base score is 8.6 (HIGH) , reflecti...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

EUVD-2026-71856

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

PT-2026-86340

🚨 CVE-2026-82304 The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. 🎖@cveNotify...

CVE-2026-81289 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...

CVE-2026-78283

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

EUVD-2026-66941

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78283

CVE-2026-78283 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Music Player for WooCommerce , affecting versions ≤ 1.8.9 . The flaw was discovered by daroo and is scored CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a ...

WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Music Player for WooCommerce versions = 1.8.9...

CVE-2026-73662

A flaw was found in the FreePBX Music on Hold module. An authenticated administrator can exploit dangerous command-line options when configuring media players, such as /usr/bin/mpg123. This allows the administrator to execute arbitrary commands as the asterisk service user by writing files, openi...

CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73662

CVE-2026-73662 affects FreePBX Music on Hold module (versions 17.0.1–17.0.7). The vulnerability arises from validateCustomConfiguration() in Music.class.php allowing dangerous command-line options to mpg123 and other allowed players, enabling an authenticated administrator to write files, open co...