35 matches found
CVE-2026-121433 AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/stationid/files/bulk so...
CVE-2026-121433
AzuraCast versions before 0.24.0 are vulnerable to a stored CSV formula injection vulnerability. This issue allows users with Media permission to persist metadata containing formula-prefixed content by using the /api/station/{station_id}/files/bulk endpoint during a bulk media import. If an attac...
CVE-2026-121430
AzuraCast versions before 0.24.0 are susceptible to a missing authorization vulnerability (CWE-862) in the GET and POST routes for /api/station/{station_id}/waveform/{media_id}. Because these routes lack necessary Permissions middleware , any authenticated user—even those without specific station...
EUVD-2026-115852
AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/stationid/waveform/mediaid routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with...
CVE-2026-121430: AzuraCast: AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST…
AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/stationid/waveform/mediaid routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/station/stationid/file/id/play endpoint. An attacker can access and download media files from stations they do not have permission to view by enumerating sequential IDs and exfiltrating the complet...
CVE-2026-100855
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100855 AzuraCast before 0.23.6 Missing Permission Check via /play
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100855
AzuraCast versions before 0.23.6 are vulnerable to a missing permission check in the GET /api/station/{station_id}/file/{id}/play endpoint. This flaw allows authenticated users to download media files from any station by enumerating sequential IDs. Consequently, an attacker can exfiltrate the com...
EUVD-2026-87820
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100855: Missing Authorization
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2024-45999
A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the getstationinfofunction located in the file /application/models/Oqrsmodel.php. The vulnerability is exploitable via the stationid parameter...
CVE-2024-48259
Cloudlog 2.6.15 allows Oqrs.php requestform SQL injection via stationid or callsign...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48255
Cloudlog 2.6.15 allows Oqrs.php getstationinfo stationid SQL injection...
CVE-2024-48255
Cloudlog 2.6.15 allows Oqrs.php getstationinfo stationid SQL injection...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48257: Improper Neutralization of Special Elements used in an SQL Command
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...