PT-2026-141218

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and show lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute...