Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

azuracast — Vulnerabilities & Security Advisories 17

Browse all 17 CVE security advisories affecting azuracast. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Azuracast serves as an open-source internet radio broadcasting platform, enabling users to manage and stream audio content. Historically, vulnerabilities have included remote code execution, cross-site scripting, and privilege escalation, often stemming from improper input validation and access control flaws. The platform's security posture has been impacted by CVEs such as those allowing unauthorized administrative access and stored XSS attacks through its web interface. While no major public security incidents have been widely documented, the presence of multiple CVEs highlights ongoing challenges in securing its web components and API endpoints, particularly around user authentication and content management features.

Found 15 results / 17 Clear Filters
Top products by azuracast: AzuraCast azuracast/azuracast
CVE ID Title CVSS Severity Published
CVE-2026-100857 AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation — AzuraCast CWE-94 8.0 High 2026-09-27
CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password — AzuraCast CWE-94 8.8 High 2026-09-27
CVE-2026-100855 AzuraCast before 0.23.6 Missing Permission Check via /play — AzuraCast CWE-862 6.5 Medium 2026-09-27
CVE-2026-100853 AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass — AzuraCast CWE-862 5.9 Medium 2026-09-27
CVE-2026-100854 AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API — AzuraCast CWE-862 6.3 Medium 2026-09-27
CVE-2026-100852 AzuraCast before 0.23.8 Command Injection via Streamer Username — AzuraCast CWE-78 8.8 High 2026-09-27
CVE-2026-100850 AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist — AzuraCast CWE-918 7.7 High 2026-09-27
CVE-2026-100851 AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile — AzuraCast CWE-200 7.6 High 2026-09-27
CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs — AzuraCast CWE-918 7.1 High 2026-09-27
CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL — AzuraCast CWE-918 7.1 High 2026-09-27
CVE-2026-100847 AzuraCast before 0.23.8 DQL Injection via sortOrder — AzuraCast CWE-89 7.5 High 2026-09-27
CVE-2026-76836 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass — AzuraCast CWE-94 8.8 High 2026-08-24
CVE-2026-42605 AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload — AzuraCast CWE-22 8.8 High 2026-05-09
CVE-2026-42606 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass — AzuraCast CWE-640 8.1 High 2026-05-09
CVE-2025-67737 AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE — AzuraCast CWE-862 3.1 Low 2025-12-12

This page lists every published CVE security advisory associated with azuracast. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.