{"id":"CVE-2026-125395","published":"2026-11-10T00:17:13.547","lastModified":"2026-11-10T19:21:12.647","description":"Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ampache/ampache","tags":[]},{"url":"https://github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.php#L70","tags":[]},{"url":"https://github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18","tags":[]},{"url":"https://github.com/ampache/ampache/releases/tag/8.4.0","tags":[]},{"url":"https://www.vulncheck.com/advisories/ampache-before-8.4.0-stored-xss-via-song-lyrics-id3-tag","tags":[]}],"exploitRefs":[{"url":"https://github.com/ampache/ampache","tags":[]},{"url":"https://github.com/ampache/ampache/blob/8.3.0/src/Gui/Song/LyricsView.php#L70","tags":[]},{"url":"https://github.com/ampache/ampache/commit/94ab8461c6b28140d438ffce915ef645af73ef18","tags":[]},{"url":"https://github.com/ampache/ampache/releases/tag/8.4.0","tags":[]}],"hasPoc":true,"ai":null}