CVE-2020-15153

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workaround. This is fixed in version 4.2.2 and the development branch.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
ampache	ampache	< 4.2.2

References

https://github.com/ampache/ampache/commit/e92cb6154c32c513b9c07e5fdbf5ac7de81ef5edPatch, Third Party Advisory
https://github.com/ampache/ampache/releases/tag/4.2.2Release Notes, Third Party Advisory
https://github.com/ampache/ampache/security/advisories/GHSA-phr3-mpx5-7826Exploit, Mitigation, Third Party Advisory
https://github.com/ampache/ampache/commit/e92cb6154c32c513b9c07e5fdbf5ac7de81ef5edPatch, Third Party Advisory
https://github.com/ampache/ampache/releases/tag/4.2.2Release Notes, Third Party Advisory
https://github.com/ampache/ampache/security/advisories/GHSA-phr3-mpx5-7826Exploit, Mitigation, Third Party Advisory

Timeline

Published: Apr 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151547.3baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit thi CVE-2020-151557.3baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit thi CVE-2020-151568.1In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post CVE-2020-151576.1In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container ima CVE-2020-151589.8In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happ CVE-2020-151597.6baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as CVE-2020-15167.8An elevation of privilege vulnerability exists when the Windows Work Folders Service improperly handles memory. To exploit this vulnerabilit CVE-2020-151609.8PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page CVE-2020-151616.1In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The pro CVE-2020-151625.4In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people CVE-2020-151638.2Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metada CVE-2020-1516410.0in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing,