Поиск уязвимостей
Количество 3
Количество 3
CVE-2025-48949
Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue.
GHSA-5wgp-vjxm-3x2r
Navidrome allows SQL Injection via role parameter
ALT-PU-2025-7663
ALT-PU-2025-7663: package `navidrome` update to version 0.56.1-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2025-48949 Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue. | CVSS3: 9.8 | 1% Низкий | больше 1 года назад |
| GHSA-5wgp-vjxm-3x2r Navidrome allows SQL Injection via role parameter | 1% Низкий | больше 1 года назад | |
| ALT-PU-2025-7663 ALT-PU-2025-7663: package `navidrome` update to version 0.56.1-alt1 | CVSS3: 9.8 | больше 1 года назад |
Уязвимостей на страницу