CVE-2024-28853

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting (XSS) vulnerability in ampache before v6.3.1 allows a remote attacker to execute code via a crafted payload to serval parameters in the post request of /preferences.php?action=admin_update_preferences. This vulnerability is fixed in 6.3.1.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
ampache	ampache	< 6.3.1
ampache	ampache	< 6.3.1

References

https://github.com/ampache/ampache/security/advisories/GHSA-prw2-7cr3-5mx8Vendor Advisory
https://github.com/ampache/ampache/security/advisories/GHSA-prw2-7cr3-5mx8Vendor Advisory

Timeline

Published: Mar 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-288547.5tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious CVE-2024-288556.1ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/templa CVE-2024-288599.0Symfony1 is a community fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP CVE-2024-28867.5Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted CVE-2024-288606.8Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium m CVE-2024-288619.8Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to CVE-2024-288625.5The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had CVE-2024-288636.5node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation proc CVE-2024-288642.6SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps CVE-2024-288657.5django-wiki is a wiki system for Django. Installations of django-wiki prior to version 0.10.1 are vulnerable to maliciously crafted article CVE-2024-288666.1GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site s CVE-2024-288677.4Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _