{"id":"CVE-2019-12386","aliases":["DLA-1988-1","EUVD-2019-4020","GHSA-367h-866v-prvm","UBUNTU-CVE-2019-12386","USN-4693-1"],"status":"published","title":"An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php...","description":"An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00839,"percentile":0.58256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-08-22T18:21:04Z","modified":"2026-06-17T02:14:32Z","fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"ampache","fixed_in":["3.6-rzb2779+dfsg-0ubuntu9.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:8","package":"ampache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-rzb2752+dfsg-5+deb8u1"}]}],"versions":["3.6-rzb2752+dfsg-5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ampache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-rzb2779+dfsg-0ubuntu9.2"}]}],"versions":["3.6-rzb2779+dfsg-0ubuntu5","3.6-rzb2779+dfsg-0ubuntu6","3.6-rzb2779+dfsg-0ubuntu7","3.6-rzb2779+dfsg-0ubuntu8","3.6-rzb2779+dfsg-0ubuntu9","3.6-rzb2779+dfsg-0ubuntu9.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ampache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-rzb2779+dfsg-0ubuntu9.2"}]}],"versions":["3.6-rzb2779+dfsg-0ubuntu5","3.6-rzb2779+dfsg-0ubuntu6","3.6-rzb2779+dfsg-0ubuntu7","3.6-rzb2779+dfsg-0ubuntu8","3.6-rzb2779+dfsg-0ubuntu9","3.6-rzb2779+dfsg-0ubuntu9.1"],"bundled":2}],"products":[{"vendor":"ampache","product":"ampache"}],"references":[{"url":"https://www.tarlogic.com/en/blog/vulnerabilities-in-ampache/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/11/msg00008.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12386"},{"url":"https://github.com/advisories/GHSA-367h-866v-prvm"},{"url":"https://ubuntu.com/security/CVE-2019-12386","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4693-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12385","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-12386","description":"An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.","status":"published","published":"2019-08-22T18:21:04Z","modified":"2024-08-04T23:17:39.984Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2019-4020","description":"An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.","status":"published","published":"2019-08-22T18:21:04Z","modified":"2024-08-04T23:17:39Z","updated_at":"2026-11-03T02:40:46.416719Z"}],"ghsa":[{"id":"GHSA-367h-866v-prvm","title":"An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php...","description":"An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.","status":"published","published":"2022-05-24T16:54:33Z","modified":"2023-01-28T05:06:45Z","updated_at":"2026-11-02T14:44:27.774415Z"}],"nvd":[{"id":"CVE-2019-12386","description":"An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.","status":"published","published":"2019-08-22T19:15:14.33Z","modified":"2026-06-17T02:14:32.61Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:23.725587Z"}],"osv":[{"id":"UBUNTU-CVE-2019-12386","description":"An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \"add instance\" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.","status":"published","published":"2019-08-22T19:15:00Z","modified":"2026-02-04T03:21:03.123755Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"DLA-1988-1","title":"ampache - security update","status":"published","published":"2019-11-11T00:00:00Z","modified":"2026-03-09T01:18:33.491897Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"USN-4693-1","title":"ampache vulnerabilities","description":"It was discovered that an SQL injection vulnerability exists in the Ampache\nsearch engine. Any user able to perform searches could dump any data contained\nin the database. An attacker could use this to disclose sensitive information.\n(CVE-2019-12385)\n\nIt was discovered that an XSS vulnerability in Ampache. An attacker could use\nthis vulnerability to force an admin to create a new privileged user.\n(CVE-2019-12386)\n","status":"published","published":"2021-01-14T21:13:09Z","modified":"2026-02-10T04:42:02Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}