Back Sploitus

CVE-2021

Sploitus • September 15, 2026

Share: View original

Эта уязвимость — XSS, которая затрагивала версии Ampache до 4.4.3.

При установке выполните проброс портов в файле docker-compose.yml. Устанавливаемая версия Ampache — 4.4.2.

Перейдите по адресу ip]:port/.

#### 2\. Подключение к Ampache и настройка MySQL

Перейдите по адресу ip]:port/. Настройте базу данных MySQL, как показано на рисунке ниже. ![image](

При вставке приведённого ниже PoC можно увидеть, что возникает XSS-уязвимость.

![image](

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Apache HTTP Server and Ampache Exposed Two significant vulnerabilities have been reported: CVE-2021-42013 in Apache HTTP Server and a cross-site scripting (XSS) vulnerability in Ampache. CVE-2021-42013 allows for remote code execution and path traversal, affecting Apache HTTP Server 2.4.50. The exploit can be executed using a crafted payload that accesses sensitive system files. Meanwhile, the Ampache vulnerability affects versions prior to 4.4.3, allowing for XSS attacks that can compromise user data. Both vulnerabilities have proof-of-concept code available, raising concerns about their exploitation in the wild. Organizations using these affected systems are advised to take immediate action to mitigate risks. 2 sources 71

Extracted Entities

CWE Weaknesses (1)

Cwe-79 - Cross-site Scripting (xss)

Platforms (2)

Tools (1)

Vulnerabilities (1)