CVE-2024-51490— Stored Cross-Site Scripting in Ampache
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-51490
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stored Cross-Site Scripting in Ampache
Source: NVD (National Vulnerability Database)
Vulnerability Description
Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users can change "Custom URL - Logo". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Ampache 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ampache是Ampache开源的一款基于Web的音频/视频应用程序和文件管理器。 Ampache 7.0.1版本存在跨站脚本漏洞，该漏洞源于用户可以在 Ampache 菜单的界面部分更改Custom URL - Logo。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-51490
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-51490
请登录查看更多情报信息。
Same Patch Batch · ampache · 2024-11-11 · 7 CVEs total
| CVE-2024-51486 | 5.5 MEDIUM | Stored Cross-Site Scripting in Ampache |
| CVE-2024-51489 | Insufficient Message Token Validation in Ampache | |
| CVE-2024-51488 | Insufficient Validation in Delete Message in Ampache | |
| CVE-2024-51487 | Insufficient Validation in Catalog (Activation/Deactivation) in Ampache | |
| CVE-2024-51484 | Insufficient Validation in Controllers (Activation/Deactivation) in Ampache | |
| CVE-2024-51485 | Insufficient Validation in Plugins (Activation/Deactivation) in Ampache |
IV. Related Vulnerabilities
Same product: ampache
- CVE-2024-51484
Insufficient Validation in Controllers (Activation/Deactivat - CVE-2024-51485
Insufficient Validation in Plugins (Activation/Deactivation) - CVE-2024-51486
Stored Cross-Site Scripting in Ampache - CVE-2024-51487
Insufficient Validation in Catalog (Activation/Deactivation) - CVE-2024-51488
Insufficient Validation in Delete Message in Ampache
Same vendor: ampache
- CVE-2024-51484
Insufficient Validation in Controllers (Activation/Deactivat - CVE-2024-51485
Insufficient Validation in Plugins (Activation/Deactivation) - CVE-2024-51486
Stored Cross-Site Scripting in Ampache - CVE-2024-51487
Insufficient Validation in Catalog (Activation/Deactivation) - CVE-2024-51488
Insufficient Validation in Delete Message in Ampache
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2024-51490
No comments yet