EUVD-2026-120558

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...

CVE-2026-125395

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...

CVE-2026-125395: ampache: Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to…

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...

CVE-2026-125395 Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics and showlyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute co...

CVE-2026-125395

Ampache versions before 8.4.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the LyricsView.php getLyrics() function and show_lyrics.inc.php , where song lyrics are not properly escaped. An attacker with upload rights can inject malicious HTML and scripts into th...