Advisories · Technology
advplyr audiobookshelf.
Every CVE that names advplyr audiobookshelf among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Audiobookshelf: Refresh Token Accepted on Resource Endpoints
- advplyr audiobookshelf
- Authentication bypass
- CVSS 7.5 High
audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal
- advplyr audiobookshelf
- Path traversal
- CVSS 6.9 Medium
Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project
- advplyr audiobookshelf
- Path traversal
- CVSS 4.5 Medium
Audiobookshelf: Stored Cross-Site Scripting in Login Page Custom Message
- advplyr audiobookshelf
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload
- advplyr audiobookshelf
- CWE-409
- CVSS 4.3 Medium
Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence
- advplyr audiobookshelf
- Path traversal
- CVSS 4.3 Medium
Audiobookshelf: Collection endpoints bypass library access controls exposing restricted library data
- advplyr audiobookshelf
- Broken access control
- CVSS 6.5 Medium
Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint
- advplyr audiobookshelf
- Broken access control
- CVSS 4.8 Medium
Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata
- advplyr audiobookshelf
- Cross-site scripting (XSS)
- CVSS 4.0 Medium
Audiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App)
- advplyr audiobookshelf
- advplyr audiobookshelf-app
- Cross-site scripting (XSS)
- CVSS 8.8 High
Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
- advplyr audiobookshelf
- Open redirect
- CWE-523
- CVSS 6.9 Medium
Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload
- advplyr audiobookshelf
- Cross-site scripting (XSS)
- CVSS 8.2 High
Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
- advplyr audiobookshelf
- Authentication bypass
- Denial of service
- CVSS 6.3 Medium
Path Traversal in audiobookshelf
- advplyr audiobookshelf
- Path traversal
- CVSS 4.8 Medium
Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks
- advplyr audiobookshelf
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Audiobookshelf vulnerable to Blind SSRF in `Auth.js`
- advplyr audiobookshelf
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Audiobookshelf vulnerable to Blind SSRF in `podcastUtils.js`
- advplyr audiobookshelf
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Audiobookshelf Arbitrary File Read Vulnerability
- advplyr audiobookshelf
- Path traversal
- CVSS 8.1 High
Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
- advplyr audiobookshelf
- Information disclosure
- Server-side request forgery (SSRF)