Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ampache — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in ampache, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities specifically affecting the Ampache media server software, categorized by weakness type and assigned security tags. The collection encompasses a wide range of reported flaws, including remote code execution, cross-site scripting, and privilege escalation issues, spanning from the software's early development phases through to its most recent stable releases. Visitors can utilize this resource to track official vendor advisories, analyze the characteristics of specific weakness classes within the Ampache codebase, or review the complete historical vulnerability record of the product to assess its security posture over time. The data presented here serves as a centralized reference for security researchers, system administrators, and developers seeking to understand the evolution of threats targeting this particular application without needing to consult multiple disparate sources. By organizing these findings chronologically and by severity, the page facilitates efficient risk assessment and helps stakeholders prioritize necessary patches or configuration changes to maintain a secure media streaming environment. All entries reflect verified reports and public disclosures, ensuring the information remains accurate and actionable for those responsible for maintaining Ampache installations.

Vendor: ampache

CVE ID Title CVSS Severity Published
CVE-2026-125395 Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag CWE-79 5.4 Medium 2026-11-09
CVE-2024-51484 Insufficient Validation in Controllers (Activation/Deactivation) in Ampache CWE-352 6.5AI Medium AI 2024-11-11
CVE-2024-51485 Insufficient Validation in Plugins (Activation/Deactivation) in Ampache CWE-352 6.5AI Medium AI 2024-11-11
CVE-2024-51486 Stored Cross-Site Scripting in Ampache CWE-79 5.5 Medium 2024-11-11
CVE-2024-51487 Insufficient Validation in Catalog (Activation/Deactivation) in Ampache CWE-352 6.5AI Medium AI 2024-11-11
CVE-2024-51488 Insufficient Validation in Delete Message in Ampache CWE-352 8.1AI High AI 2024-11-11
CVE-2024-51489 Insufficient Message Token Validation in Ampache CWE-352 8.1AI High AI 2024-11-11
CVE-2024-51490 Stored Cross-Site Scripting in Ampache CWE-79 5.5 Medium 2024-11-11
CVE-2024-47828 Cross-Site Request Forgery in ampache CWE-352 5.3 Medium 2024-10-09
CVE-2024-47184 Ampache vulnerable to Stored XSS via Democratic Playlist Name CWE-79 6.1 Medium 2024-09-27
CVE-2024-41665 Ampache Stored Cross-site Scripting Vulnerability CWE-79 5.5 Medium 2024-07-23
CVE-2024-28852 Ampache has multiple reflective XSS vulnerabilities CWE-79 6.1 Medium 2024-03-27
CVE-2024-28853 Ampache Stored XSS CWE-79 3.9 Low 2024-03-27
CVE-2021-32644 Cross-site Scripting in Random.php CWE-79 6.4 Medium 2021-06-22
CVE-2020-15153 Unauthenticated SQL injection in Ampache CWE-89 8.2 High 2021-04-30
CVE-2021-21399 Unauthenticated SubSonic backend access in Ampache CWE-284 9.1 Critical 2021-04-13

All 16 known CVE vulnerabilities affecting ampache with full Chinese analysis, references, and POCs where available.