30 matches found
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/station/stationid/file/id/play endpoint. An attacker can access and download media files from stations they do not have permission to view by enumerating sequential IDs and exfiltrating the complet...
CVE-2026-100855
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
EUVD-2026-87820
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100855
AzuraCast versions before 0.23.6 are vulnerable to a missing permission check in the GET /api/station/{station_id}/file/{id}/play endpoint. This flaw allows authenticated users to download media files from any station by enumerating sequential IDs. Consequently, an attacker can exfiltrate the com...
CVE-2026-100855 AzuraCast before 0.23.6 Missing Permission Check via /play
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2026-100855: Missing Authorization
AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...
CVE-2024-45999
A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the getstationinfofunction located in the file /application/models/Oqrsmodel.php. The vulnerability is exploitable via the stationid parameter...
CVE-2024-48259
Cloudlog 2.6.15 allows Oqrs.php requestform SQL injection via stationid or callsign...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48255
Cloudlog 2.6.15 allows Oqrs.php getstationinfo stationid SQL injection...
CVE-2024-48259
Cloudlog 2.6.15 allows Oqrs.php requestform SQL injection via stationid or callsign...
CVE-2024-48255
Cloudlog 2.6.15 allows Oqrs.php getstationinfo stationid SQL injection...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48257
Summary : CVE-2024-48257 affects Wavelog 1.8.5. The vulnerability is an SQL injection in the Oqrs_model.php get_worked_modes function, exploitable via the station_id parameter. The issue is documented across multiple sources (NVD, Red Hat, OSV, CVE records) with high severity per CVSS metrics, in...
CVE-2024-48259
Cloudlog 2.6.15 allows Oqrs.php requestform SQL injection via stationid or callsign...
CVE-2024-48255: Improper Neutralization of Special Elements used in an SQL Command
Cloudlog 2.6.15 allows Oqrs.php getstationinfo stationid SQL injection...
CVE-2024-48257: Improper Neutralization of Special Elements used in an SQL Command
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...