Advisories · Technology
Tautulli.
Every CVE that names Tautulli among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
Tautulli: Reflected XSS in `/search` endpoint
- Tautulli
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter
- Tautulli
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Tautulli: Open redirect via whitespace bypass in /auth/redirect
- Tautulli
- Open redirect
- CVSS 7.0 High
Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database
- Tautulli
- Path traversal
- Unrestricted file upload
- CVSS 9.9 CriticalCritical · CVSS 9+
Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay
- Tautulli
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover
- Tautulli
- Cross-site request forgery (CSRF)
- CVSS 8.9 High
Tautulli has stored XSS in logFile via guest-controlled log_js_errors input
- Tautulli
- Cross-site scripting (XSS)
- CVSS 8.9 High
Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory
- Tautulli
- Code injection
- CVSS 5.7 Medium
Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API
- Tautulli
- Path traversal
- CVSS 7.4 High
Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft
- Tautulli
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters
- Tautulli
- SQL injection
- CWE-20
- CVSS 8.7 High
Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
- Tautulli
- Path traversal
- CVSS 4.0 Medium
Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server
- Tautulli
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check
- Tautulli
- Code injection
- CVSS 8.1 High
Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection
- Tautulli
- Command injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent
- Tautulli
- Path traversal
- CVSS 8.6 High
Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
- Tautulli
- CWE-27
- CVSS 8.6 High
Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint
- Tautulli
- Path traversal