go.senan.xyz/gonic vulnerabilities (Go)
3 vulnerabilities.
go.senan.xyz/gonicGogonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host8.1 Highgo.senan.xyz/gonicGoSubsonic API: any authenticated user can delete or read any other user's playlist (IDOR)7.1 Highgo.senan.xyz/gonicGoPath traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist7.1 High