https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T04:22:08.001799+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-120441 fkie_cve-2026-120441 2026-11-05T04:22:08.025225+00:00

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

 https://db.gcve.eu/vuln/ghsa-fhcc-7j5h-5hf8 GHSA-fhcc-7j5h-5hf8 2026-11-05T04:22:08.025321+00:00

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.