ampache records

25 published records for vendor ampache.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 48%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

25 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2020-15153No exploit	Unauthenticated SQL injection in Ampacheampache · ampache · CWE-89 Pre-auth SQL injection	Critical9.8	—	2.4%	Apr 30, 2021
36Monitor	CVE-2024-51490No exploit	Stored Cross-Site Scripting in Ampacheampache · ampache · CWE-79 XSS	Critical9.0	—	0.5%	Nov 11, 2024
35Monitor	CVE-2019-12385No exploit	An issue was discovered in Ampache through 3.9.1.ampache · ampache · CWE-89 SQL injection	High8.8	—	1.6%	Aug 22, 2019
35Monitor	CVE-2017-18375No exploit	Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.ampache · ampache · CWE-502 Deserialization	High8.8	—	1.6%	May 24, 2019
35Monitor	CVE-2022-4665No exploit	Unrestricted Upload of File with Dangerous Type in ampache/ampacheampache · ampache · CWE-434 File upload	High8.8	—	0.8%	Dec 22, 2022
35Monitor	CVE-2023-0771No exploit	SQL Injection in ampache/ampacheampache · ampache · CWE-89 SQL injection	High8.8	—	0.7%	Feb 9, 2023
33Monitor	CVE-2024-51486No exploit	Stored Cross-Site Scripting in Ampacheampache · ampache · CWE-79 XSS	High8.4	—	0.5%	Nov 11, 2024
30Monitor	CVE-2006-5668No exploit	Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restricampache · ampache Pre-auth	High7.5	—	1.6%	Nov 2, 2006
30Monitor	CVE-2021-21399No exploit	Unauthenticated SubSonic backend access in Ampacheampache · ampache · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	High7.5	—	1.4%	Apr 13, 2021
28Monitor	CVE-2008-3929No exploit	gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary fileampache · ampache · CWE-59	High7.2	—	0.4%	Sep 4, 2008
27Monitor	CVE-2007-4438No exploit	Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors.ampache · ampache · CWE-287 Pre-auth Auth bypass	Medium6.8	—	1.5%	Aug 20, 2007
27Monitor	CVE-2007-4437No exploit	SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote attackers to execute arbitrary SQL commands via the match ampache · ampache pre-auth RCE SQL injection	Medium6.8	—	1.3%	Aug 20, 2007
26Monitor	CVE-2024-47828No exploit	Cross-Site Request Forgery in ampacheampache · ampache · CWE-352 Pre-auth CSRF	Medium6.5	—	0.3%	Oct 9, 2024
24Monitor	CVE-2023-0606No exploit	Cross-site Scripting (XSS) - Reflected in ampache/ampacheampache · ampache · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	Jan 31, 2023
24Monitor	CVE-2024-28852No exploit	Ampache has multiple reflective XSS vulnerabilitiesampache · ampache · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Mar 27, 2024
23Monitor	CVE-2024-28853No exploit	Ampache is a web based audio/video streaming application and file manager.ampache · ampache · CWE-79 XSS	Medium5.9	—	0.6%	Mar 27, 2024
21Monitor	CVE-2021-32644Proof of concept	Cross-site Scripting in Random.phpampache · ampache · CWE-79 RCE XSS	Medium5.4	—	0.8%	Jun 22, 2021
21Monitor	CVE-2019-12386No exploit	An issue was discovered in Ampache through 3.9.1.ampache · ampache · CWE-79 XSS	Medium5.4	—	0.8%	Aug 22, 2019
21Monitor	CVE-2024-41665No exploit	Ampache Stored Cross-site Scripting Vulnerabilityampache · ampache · CWE-79 XSS	Medium5.4	—	0.5%	Jul 23, 2024
21Monitor	CVE-2024-51485No exploit	Insufficient Validation in Plugins (Activation/Deactivation) in Ampacheampache · ampache · CWE-352 CSRF	Medium5.3	—	0.3%	Nov 11, 2024
21Monitor	CVE-2024-51484No exploit	Insufficient Validation in Controllers (Activation/Deactivation) in Ampacheampache · ampache · CWE-352 CSRF	Medium5.3	—	0.3%	Nov 11, 2024
21Monitor	CVE-2024-51487No exploit	Insufficient Validation in Catalog (Activation/Deactivation) in Ampacheampache · ampache · CWE-352 CSRF	Medium5.3	—	0.3%	Nov 11, 2024
21Monitor	CVE-2024-51489No exploit	Insufficient Message Token Validation in Ampacheampache · ampache · CWE-352 CSRF	Medium5.3	—	0.3%	Nov 11, 2024
21Monitor	CVE-2024-51488No exploit	Insufficient Validation in Delete Message in Ampacheampache · ampache · CWE-352 CSRF	Medium5.3	—	0.3%	Nov 11, 2024
19Monitor	CVE-2024-47184No exploit	Ampache vulnerable to Stored XSS via Democratic Playlist Nameampache · ampache · CWE-79 XSS	Medium4.8	—	0.6%	Sep 27, 2024

CVE-2020-15153
40Plan
Unauthenticated SQL injection in Ampache
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- SQL injection
ampache · ampacheApr 30, 2021
CVE-2024-51490
36Monitor
Stored Cross-Site Scripting in Ampache
CriticalCVSS 9.0No exploitEPSS 1%
- XSS
ampache · ampacheNov 11, 2024
CVE-2019-12385
35Monitor
An issue was discovered in Ampache through 3.9.1.
HighCVSS 8.8No exploitEPSS 2%
- SQL injection
ampache · ampacheAug 22, 2019
CVE-2017-18375
35Monitor
Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.
HighCVSS 8.8No exploitEPSS 2%
- Deserialization
ampache · ampacheMay 24, 2019
CVE-2022-4665
35Monitor
Unrestricted Upload of File with Dangerous Type in ampache/ampache
HighCVSS 8.8No exploitEPSS 1%
- File upload
ampache · ampacheDec 22, 2022
CVE-2023-0771
35Monitor
SQL Injection in ampache/ampache
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
ampache · ampacheFeb 9, 2023
CVE-2024-51486
33Monitor
Stored Cross-Site Scripting in Ampache
HighCVSS 8.4No exploitEPSS 0%
- XSS
ampache · ampacheNov 11, 2024
CVE-2006-5668
30Monitor
Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restric
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
ampache · ampacheNov 2, 2006
CVE-2021-21399
30Monitor
Unauthenticated SubSonic backend access in Ampache
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
ampache · ampacheApr 13, 2021
CVE-2008-3929
28Monitor
gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary file
HighCVSS 7.2No exploitEPSS 0%
ampache · ampacheSep 4, 2008
CVE-2007-4438
27Monitor
Session fixation vulnerability in Ampache before 3.3.3.5 allows remote attackers to hijack web sessions via unspecified vectors.
MediumCVSS 6.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
ampache · ampacheAug 20, 2007
CVE-2007-4437
27Monitor
SQL injection vulnerability in albums.php in Ampache before 3.3.3.5 allows remote attackers to execute arbitrary SQL commands via the match
MediumCVSS 6.8No exploitEPSS 1%
- pre-auth RCE
- SQL injection
ampache · ampacheAug 20, 2007
CVE-2024-47828
26Monitor
Cross-Site Request Forgery in ampache
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
ampache · ampacheOct 9, 2024
CVE-2023-0606
24Monitor
Cross-site Scripting (XSS) - Reflected in ampache/ampache
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
ampache · ampacheJan 31, 2023
CVE-2024-28852
24Monitor
Ampache has multiple reflective XSS vulnerabilities
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
ampache · ampacheMar 27, 2024
CVE-2024-28853
23Monitor
Ampache is a web based audio/video streaming application and file manager.
MediumCVSS 5.9No exploitEPSS 1%
- XSS
ampache · ampacheMar 27, 2024
CVE-2021-32644
21Monitor
Cross-site Scripting in Random.php
MediumCVSS 5.4Proof of conceptEPSS 1%
- RCE
- XSS
ampache · ampacheJun 22, 2021
CVE-2019-12386
21Monitor
An issue was discovered in Ampache through 3.9.1.
MediumCVSS 5.4No exploitEPSS 1%
- XSS
ampache · ampacheAug 22, 2019
CVE-2024-41665
21Monitor
Ampache Stored Cross-site Scripting Vulnerability
MediumCVSS 5.4No exploitEPSS 0%
- XSS
ampache · ampacheJul 23, 2024
CVE-2024-51485
21Monitor
Insufficient Validation in Plugins (Activation/Deactivation) in Ampache
MediumCVSS 5.3No exploitEPSS 0%
- CSRF
ampache · ampacheNov 11, 2024
CVE-2024-51484
21Monitor
Insufficient Validation in Controllers (Activation/Deactivation) in Ampache
MediumCVSS 5.3No exploitEPSS 0%
- CSRF
ampache · ampacheNov 11, 2024
CVE-2024-51487
21Monitor
Insufficient Validation in Catalog (Activation/Deactivation) in Ampache
MediumCVSS 5.3No exploitEPSS 0%
- CSRF
ampache · ampacheNov 11, 2024
CVE-2024-51489
21Monitor
Insufficient Message Token Validation in Ampache
MediumCVSS 5.3No exploitEPSS 0%
- CSRF
ampache · ampacheNov 11, 2024
CVE-2024-51488
21Monitor
Insufficient Validation in Delete Message in Ampache
MediumCVSS 5.3No exploitEPSS 0%
- CSRF
ampache · ampacheNov 11, 2024
CVE-2024-47184
19Monitor
Ampache vulnerable to Stored XSS via Democratic Playlist Name
MediumCVSS 4.8No exploitEPSS 1%
- XSS
ampache · ampacheSep 27, 2024