CVE-2021-32644mediumCWE-79

CVE-2021-32644: medium-severity vulnerability in ampache

Cross-site Scripting in Random.php

Published · Updated

Follow this CVE+ Monitor ampache

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.8%
Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
ampache · ampache
Related CVEs — ampache

In the same product, most dangerous first.

CVE-2020-15153HIGHUnauthenticated SQL injection in AmpacheEPSS 2.4%CVE-2021-21399CRITICALUnauthenticated SubSonic backend access in AmpacheEPSS 1.4%CVE-2024-28853LOWAmpache Stored XSSEPSS 0.6%CVE-2024-47184MEDIUMAmpache vulnerable to Stored XSS via Democratic Playlist NameEPSS 0.5%CVE-2024-51490MEDIUMStored Cross-Site Scripting in AmpacheEPSS 0.5%CVE-2024-51486MEDIUMStored Cross-Site Scripting in AmpacheEPSS 0.5%