Skip to content
OpenAdvisories

Vendor

OwnTone

3 known vulnerabilities.

Products

OwnTone Server 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-120441

    OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

    OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listene…

    OwnTone OwnTone Server
  • Medium 6.9
    CVE-2026-41457

    OwnTone Server < 29.1 SQL Injection via query and filter Parameters

    OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-map…

    OwnTone OwnTone Server