Skip to content
OpenAdvisories
Unscored USN-4693-1 2 CVEs

ampache vulnerabilities

Published Jan 14, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that an SQL injection vulnerability exists in the Ampache
search engine. Any user able to perform searches could dump any data contained
in the database. An attacker could use this to disclose sensitive information.
(CVE-2019-12385)

It was discovered that an XSS vulnerability in Ampache. An attacker could use
this vulnerability to force an admin to create a new privileged user.
(CVE-2019-12386)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS ampache 3.6-rzb2779+dfsg-0ubuntu9.2

Vulnerabilities 2

  • Unscored —
    CVE-2019-12385

    An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to…

    ampache Ubuntu
  • Unscored —
    CVE-2019-12386

    An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" fun…

    ampache Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2019-12385
  • report
    https://ubuntu.com/security/CVE-2019-12386