CVE-2026-54493 Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API...

CVE-2018-20228

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

CVE-2018-20228: Cross-Site Request Forgery (CSRF)

Subsonic V6.1.5 allows internetRadioSettings.view streamUrl CSRF, with resultant SSRF...

Subsonic Server-Side Request Forgery Vulnerability

Subsonic is a media file hosting platform. A request forgery vulnerability exists on the server side of Subsonic. The vulnerability is located in the "internetRadioSettings.view" module and in the "streamUrl" parameter of the localhost path URL. This could allow a remote attacker to hijack the...

Subsonic cross-site scripting vulnerability (CNVD-2018-19874)

Subsonic is a media file hosting platform. The 'namex', 'streamUrlx', and 'homepageUrlx' in the Subsonic version 6.1.1 A cross-site scripting vulnerability exists in the 'namex', 'streamUrlx', and 'homepageUrlx' parameters, which can be exploited by a remote attacker by sending 'namex',...

CVE-2018-14688: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Subsonic 6.1.1. The radio settings are affected by three stored cross-site scripting vulnerabilities in the namex, streamUrlx, homepageUrlx parameters where x is an integer to internetRadioSettings.view that could be used to steal session information of a victim...