advplyr

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

advplyr records in CISA KEV

No advplyr vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Audiobookshelf 11 records HIGH Audiobookshelf Mobile App 2 records MEDIUM

Records

20 records

TI-2025-18874 CVE-2025-25205

Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

HIGH 75

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.04753 Published 2025-02-12 Fixed in 2.19.1 CWE-202

TI-2025-35683 CVE-2025-57800

Audiobookshelf vulnerable to OIDC token exfiltration and account takeover

HIGH 73

Audiobookshelf is an open-source self-hosted audiobook server.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0046 Published 2025-08-22 Fixed in 2.28.0 CWE-523

TI-2026-49884 CVE-2026-71209 · GHSA-8885-9f28-m6p3

Path traversal in advplyr audiobookshelf

HIGH 72

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02247 Published 2026-08-05 No fix listed CWE-22

TI-2025-29079 CVE-2025-46338

Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload

HIGH 70

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0037 Published 2025-04-29 Fixed in 2.21.0 CWE-79

TI-2023-25761 CVE-2023-47619

Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability

HIGH 70

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00607 Published 2023-12-13 No fix listed CWE-200

TI-2026-31089 CVE-2026-42883

Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint

MEDIUM 62

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00255 Published 2026-05-11 Fixed in 2.32.2 CWE-863

TI-2024-29391 CVE-2024-43797

Path Traversal in audiobookshelf

MEDIUM 61

audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00546 Published 2024-09-02 Fixed in 2.13.0 CWE-22

TI-2026-51292 CVE-2026-73085

Audiobookshelf: Refresh Token Accepted on Resource Endpoints

MEDIUM 57

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00465 Published 2026-08-11 Fixed in 2.36.0 CWE-287

TI-2026-31092 CVE-2026-42886

Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload

MEDIUM 56

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00309 Published 2026-05-11 Fixed in 2.33.2 CWE-409

TI-2026-22316 CVE-2026-27974

Audiobooksheld VUlnerable to Stored XSS in WrappingMarquee.js via Audiobook Metadata (Mobile App Audio Player)

MEDIUM 55

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0022 Published 2026-02-26 Fixed in 0.12.0-beta CWE-79

TI-2026-22306 CVE-2026-27963

Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata

MEDIUM 55

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00264 Published 2026-02-26 Fixed in 2.32.0 CWE-79

TI-2024-23305 CVE-2024-35236

Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks

MEDIUM 55

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00831 Published 2024-05-27 Fixed in 2.10.0 CWE-79

TI-2026-31093 CVE-2026-42887

Audiobookshelf: Stored Cross-Site Scripting in Login Page Custom Message

MEDIUM 54

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.5 Network High privileges User interaction EPSS 0.00258 Published 2026-05-11 Fixed in 2.33.0 CWE-79

TI-2026-31091 CVE-2026-42885

Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence

MEDIUM 53

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00282 Published 2026-05-11 Fixed in 2.33.2 CWE-22

TI-2026-31090 CVE-2026-42884

Audiobookshelf: Collection endpoints bypass library access controls exposing restricted library data

MEDIUM 53

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00199 Published 2026-05-11 Fixed in 2.33.2 CWE-863

TI-2026-31094 CVE-2026-42888

Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project

LOW 36

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00331 Published 2026-05-11 Fixed in 2.33.2 CWE-22

TI-2023-25766 CVE-2023-47624

Audiobookshelf Arbitrary File Read Vulnerability

LOW 34

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00826 Published 2023-12-13 No fix listed CWE-22

TI-2023-28343 CVE-2023-51697

Audiobookshelf vulnerable to Blind SSRF in `podcastUtils.js`

LOW 33

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00349 Published 2023-12-27 Fixed in 2.7.0 CWE-918

TI-2023-28312 CVE-2023-51665

Audiobookshelf vulnerable to Blind SSRF in `Auth.js`

LOW 33

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00349 Published 2023-12-27 Fixed in 2.7.0 CWE-918

TI-2026-22315 CVE-2026-27973

Audiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App)

LOW 21

Audiobookshelf is a self-hosted audiobook and podcast server.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00192 Published 2026-02-26 Fixed in 2.12.0, 0.12.0-beta CWE-79

Open these records in search →