Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: LMS Community Clear all filters
TI-2026-36988 CVE-2026-50235 · GHSA-qpxh-62pf-qh76

Lyrion Music Server 9.2.0 Reflected XSS via search Parameters

Priority LOW 22

Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00158 Published 2026-06-05 No fix listed CWE-79
TI-2026-36987 CVE-2026-50234 · GHSA-c46g-chv5-xw5r

Lyrion Music Server 9.2.0 Path Traversal File Read

Priority HIGH 77

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00782 Published 2026-06-05 No fix listed CWE-22
TI-2026-36986 CVE-2026-50233 · GHSA-36hm-c9f8-f8xc

Lyrion Music Server 9.2.0 Arbitrary Directory Listing

Priority LOW 36

Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00294 Published 2026-06-05 No fix listed CWE-548
TI-2026-36985 CVE-2026-50232 · GHSA-v3rr-mvqc-gmm2

Lyrion Music Server 9.2.0 Stored XSS via Metadata Tags

Priority MEDIUM 56

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00237 Published 2026-06-05 No fix listed CWE-79
TI-2026-36984 CVE-2026-50231 · GHSA-4hhv-5h2w-9qm2

Lyrion Music Server 9.2.0 Unauthenticated Stored XSS via server.log

Priority LOW 28

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00183 Published 2026-06-05 No fix listed CWE-79
TI-2026-36983 CVE-2026-50230 · GHSA-rxf9-fjjc-h697

Lyrion Music Server 9.2.0 Reflected XSS via server.log

Priority LOW 23

Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log endpoint that allows attackers to inject arbitrary HTML and JavaScript code through the search paramete…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00406 Published 2026-06-05 No fix listed CWE-79