Description
An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.
Remediation
References
Related Vulnerabilities
WordPress Plugin BuddyPress Multiple Vulnerabilities (5.1.2)
Drupal Core 8.7.x Security Bypass (8.7.0 - 8.7.10)
WordPress Plugin WP Table Builder-WordPress Table Security Bypass (1.3.15)
MySQL CVE-2012-0115 Vulnerability (CVE-2012-0115)
MediaWiki URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-10959)