https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-06T18:52:49.166924+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-120441 CVE-2026-120441 — OwnTone Server through 29.3 SQL Injection via MPD sticker find Command 2026-11-06T18:52:49.170282+00:00

Affected: OwnTone Server

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.