Cloudlog - SQL Injection

Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php requestform, letting attackers execute arbitrary SQL commands via stationid or callsign, exploit requires sending crafted request. id: CVE-2024-48259 info: name: Cloudlog - SQL Injection author: s4e-io severity: high...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the GET /api/station/id/vue/profile endpoint. An attacker can obtain sensitive credentials, including admin, source, and relay passwords, by making authenticated requests with only View Station Page permission...

CVE-2026-100851

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

CVE-2026-100849

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

EUVD-2026-87837

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

CVE-2026-100851

AzuraCast versions prior to 0.23.8 are vulnerable to a broken access control flaw in the GET /api/station/{id}/vue/profile endpoint. This vulnerability allows authenticated users possessing only View Station Page permissions to access sensitive information, specifically Icecast/Shoutcast admin, s...

CVE-2026-100851 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

CVE-2026-100851 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

CVE-2026-100851 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

EUVD-2026-87839

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

PT-2026-99469

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Insufficient URL validation in the getValidUrl function within the AbstractConnector.php file allows for server-side request forgery. The validation process only rejects literal link-local IP...

PT-2026-99470

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description An issue exists in the AutoDJ remote playlist fetch functionality within the getMediaFromRemoteUrl function. A user with station Media permissions can create or update a playlist by setting source...

CVE-2026-100851: Exposure of Sensitive Information to an Unauthorized Actor

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

CVE-2026-100849: Server-Side Request Forgery (SSRF)

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

PT-2026-99471

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Broken access control allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. By calling the 'GET /api/station/id/vue/profil...

EUVD-2026-43096

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend...

CVE-2026-44383

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend...

PT-2026-57340

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw in the EV charging station backend allows multiple connections using the same charging station ID. This could enable an attacker to deploy multiple...

PT-2026-41224

Summary The GET /api/station/station id/file/id/play endpoint, handled by PlayAction, is missing the MiddlewarePermissions check that protects all sibling routes in the same /file/id route group. Any authenticated user can download media files from any station, regardless of whether they have...

PT-2026-99475

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.6 Description An issue exists where a missing permission check in the 'GET /api/station/station id/file/id/play' endpoint allows authenticated users to download media files from any station. This can be exploit...