Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-47167 State: PUBLISHED Published: 2024-10-10T21:47:29.389Z Last Updated: 2024-10-11T15:27:37.782Z Vendors: gradio-app Products: gradio Problem Types: CWE-918 Description: Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **Server-Side Request Forgery (SSRF)** in the `/queue/join` endpoint. Gradio’s `async_save_url_to_cache` function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable attackers to target internal servers or services within a local network and possibly exfiltrate data or cause unwanted internal requests. Additionally, the content from these URLs is stor
work and possibly exfiltrate data or cause unwanted internal requests. Additionally, the content from these URLs is stored locally, making it easier for attackers to upload potentially malicious files to the server. This impacts users deploying Gradio servers that use components like the Video component which involve URL fetching. Users are advised to upgrade to `gradio>=5` to address this issue. As a workaround, users can disable or heavily restrict URL-based inputs in their Gradio applications to trusted domains only. Additionally, implementing stricter URL validation (such as allowinglist-based validation) and ensuring that local or internal network addresses cannot be requested via the `
ch as allowinglist-based validation) and ensuring that local or internal network addresses cannot be requested via the `/queue/join` endpoint can help mitigate the risk of SSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gradio-app/gradio/security/advisories/GHSA-576c-3j53-r9jj
CVE ID: CVE-2024-47168 State: PUBLISHED Published: 2024-10-10T21:44:51.114Z Last Updated: 2024-10-11T15:28:22.945Z Vendors: gradio-app Products: gradio Problem Types: CWE-670 Description: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring dashboard by directly requesting the /monitoring endpoint. This means that sensitive application analytics may still be exposed, particularly in environments where monitoring is expected to be disabled
ive application analytics may still be exposed, particularly in environments where monitoring is expected to be disabled. Users who set enable_monitoring=False to prevent unauthorized access to monitoring data are impacted. Users are advised to upgrade to gradio>=4.44 to address this issue. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gradio-app/gradio/security/advisories/GHSA-hm3c-93pg-4cxw
CVE ID: CVE-2024-47169 State: PUBLISHED Published: 2024-09-26T17:11:42.815Z Last Updated: 2024-09-26T18:23:22.262Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: agnaistic Products: agnai Problem Types: CWE-35, CWE-434 Description: Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats. This does n
ld result in unauthorized access, full server compromise, data leakage, and other critical security threats. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. This does affect publicly hosted installs without S3-compatible storage. Version 1.0.330 fixes this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/agnaistic/agnai/security/advisories/GHSA-mpch-89gm-hm83
CVE ID: CVE-2024-47170 State: PUBLISHED Published: 2024-09-26T17:16:21.950Z Last Updated: 2025-03-12T21:16:50.484Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: agnaistic Products: agnai Problem Types: CWE-35 Description: Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files. This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosti
l configuration files. This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only. Version 1.0.330 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h
CVE ID: CVE-2024-47171 State: PUBLISHED Published: 2024-09-26T17:21:52.646Z Last Updated: 2024-09-26T17:53:23.119Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: agnaistic Products: agnai Problem Types: CWE-35 Description: Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compa
ing of existing images which may be used for defacement. This does not affect `agnai.chat`, installations using S3-compatible storage, or self-hosting that is not publicly exposed. Version 1.0.330 fixes this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/agnaistic/agnai/security/advisories/GHSA-g54f-66mw-hv66 - https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/character.ts#L140: - https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/upload.ts#L55
CVE ID: CVE-2024-47172 State: PUBLISHED Published: 2024-09-30T15:00:53.528Z Last Updated: 2024-09-30T15:45:56.182Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: cvat-ai Products: cvat Problem Types: CWE-863 Description: Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve certain information about any project, task, job or membership resource on the CVAT instance. The information exposed in this way is the same as the information returned on a GET request to the resource. In addition, the attacker can also alter the default source and target storage associ
on a GET request to the resource. In addition, the attacker can also alter the default source and target storage associated with any project or task. Upgrade to CVAT 2.19.1 or any later version to fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cvat-ai/cvat/security/advisories/GHSA-gxhm-hg65-5gh2 - https://github.com/cvat-ai/cvat/commit/59ce6ca784a0d426b2cfb8cf2850ba1d520c03f5
CVE ID: CVE-2024-47173 State: PUBLISHED Published: 2024-10-24T18:54:12.478Z Last Updated: 2024-10-24T20:00:27.605Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: aimeos Products: ai-admin-graphql Problem Types: CWE-270 Description: Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affected by a potential denial of service attack. Version 2024.07.2 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-qxgx-hvg3-v92w
CVE ID: CVE-2024-47174 State: PUBLISHED Published: 2024-09-26T17:27:53.966Z Last Updated: 2024-09-26T17:49:28.342Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NixOS Products: nix Problem Types: CWE-287 Description: Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, `<nix/fetchurl.nix>` did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle (MITM) attack. `<nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the
nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue. A user may be affected by the risk of leaking credentials if they have a `netrc` file for authentication, or rely on derivations with `impureEnvVars` set to use credentials from the environment. In addition, the commonplace trust-on-first-use (TOFU) technique of updating dependencies by specifying an invalid hash and obtaining it from a remote store was also vulnerable to a MITM injecting arbitrary store objects. This also applied to the impure derivations experimental feature. Note that thi
MITM injecting arbitrary store objects. This also applied to the impure derivations experimental feature. Note that this may also happen when using Nixpkgs fetchers to obtain new hashes when not using the fake hash method, although that mechanism is not implemented in Nix itself but rather in Nixpkgs using a fixed-output derivation. The behavior was introduced in version 1.11 to make it consistent with the Nixpkgs `pkgs.fetchurl` and to make `<nix/fetchurl.nix>` work in the derivation builder sandbox, which back then did not have access to the CA bundles by default. Nowadays, CA bundles are bind-mounted on Linux. This issue has been fixed in Nix 2.18.8 and 2.24.8. As a workaround, implement
ys, CA bundles are bind-mounted on Linux. This issue has been fixed in Nix 2.18.8 and 2.24.8. As a workaround, implement (authenticated) fetching with `pkgs.fetchurl` from Nixpkgs, using `impureEnvVars` and `curlOpts` as needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NixOS/nix/security/advisories/GHSA-6fjr-mq49-mm2c - https://github.com/NixOS/nix/pull/11585 - https://github.com/NixOS/nix/commit/062b4a489e30da9c85fa4ff15cfdd2e51cac7b90 - https://github.com/NixOS/nix/commit/5db358d4d78aea7204a8f22c5bf2a309267ee038
CVE ID: CVE-2024-47175 State: PUBLISHED Published: 2024-09-26T21:18:25.265Z Last Updated: 2025-11-03T22:20:02.661Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: OpenPrinting Products: libppd Problem Types: CWE-20 Description: CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to
ntrolled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 - https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 - https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 - https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 - https://www.cups.org - https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-
ty/advisories/GHSA-w63j-6g73-wmg5 - https://www.cups.org - https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
CVE ID: CVE-2024-47176 State: PUBLISHED Published: 2024-09-26T21:13:05.913Z Last Updated: 2025-11-04T21:08:56.576Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: OpenPrinting Products: cups-browsed Problem Types: CWE-1327 Description: CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2
t-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8 - https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47 - https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 - https://github.com/OpenPrinting/libppd/secu
ub.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5 - https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6 - https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992 - https://www.cups.org - https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
CVE ID: CVE-2024-47177 State: REJECTED Published: 2024-09-26T21:56:36.661Z Last Updated: 2025-05-12T21:08:50.663Z Description: No description available.
CVE ID: CVE-2024-47178 State: PUBLISHED Published: 2024-09-30T15:09:59.513Z Last Updated: 2024-09-30T16:01:32.189Z Vendors: expressjs Products: basic-auth-connect Problem Types: CWE-208 Description: basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/expressjs/basic-auth-connect/security/advisories/GHSA-7p89-p6hx-q4fw - https://github.com/expressjs/basic-auth-connect/commit/bac1e6a8530e1efd0028800b9b588a37adb0d203
CVE ID: CVE-2024-47179 State: PUBLISHED Published: 2024-09-26T19:10:28.032Z Last Updated: 2024-10-02T20:05:35.951Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: DIYgod Products: RSSHub Problem Types: CWE-20 Description: RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning, which could have lead to a full repository takeover. Downstream users of RSSHub are not vulnerable to this issue, and commit 64e00e7 fixed the underlying issue and made the repository no longer vulnerable. The `docker-test-cont.yml` workflow gets triggered when the `PR - Docker build test` workflow completes success
nerable. The `docker-test-cont.yml` workflow gets triggered when the `PR - Docker build test` workflow completes successfully. It then collects some information about the Pull Request that triggered the triggering workflow and set some labels depending on the PR body and sender. If the PR also contains a `routes` markdown block, it will set the `TEST_CONTINUE` environment variable to `true`. The workflow then downloads and extracts an artifact uploaded by the triggering workflow which is expected to contain a single `rsshub.tar.zst` file. However, prior to commit 64e00e7, it did not validate and the contents were extracted in the root of the workspace overriding any existing files. Since the
t did not validate and the contents were extracted in the root of the workspace overriding any existing files. Since the contents of the artifact were not validated, it is possible for a malicious actor to send a Pull Request which uploads, not just the `rsshub.tar.zst` compressed docker image, but also a malicious `package.json` file with a script to run arbitrary code in the context of the privileged workflow. As of commit 64e00e7, this scenario has been addressed and the RSSHub repository is no longer vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DIYgod/RSSHub/security/advisories/GHSA-9mqc-fm24-h8cw - https://github.com/DIYgod/RSSHub/commi
ces: - https://github.com/DIYgod/RSSHub/security/advisories/GHSA-9mqc-fm24-h8cw - https://github.com/DIYgod/RSSHub/commit/64e00e743aba2a239508fea97825994e3d687ecc - https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection - https://github.com/DIYgod/RSSHub/actions/runs/10141104413/job/28037643579#step:1:17 - https://github.com/DIYgod/RSSHub/blob/e08733f94c81440d19ee6a5fd5e915e9a65395f5/.github/workflows/docker-test-cont.yml - https://securitylab.github.com/advisories/GHSL-2024-178_RSSHub - https://securitylab.github.com/research/github-actions-preventing-pwn-requests - https://securitylab.github.com/research/github-actions-untrusted-input
CVE ID: CVE-2024-47180 State: PUBLISHED Published: 2024-09-26T19:21:04.584Z Last Updated: 2024-09-26T19:47:50.375Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: badges Products: shields Problem Types: CWE-74 Description: Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version < `server-2024-09-25` are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic JSON/Toml/Yaml badges. This vulnerability would allow any user with access to make a request to a URL on the instance to the ability to execute code by cra
bility would allow any user with access to make a request to a URL on the instance to the ability to execute code by crafting a malicious JSONPath expression. All users who self-host an instance are vulnerable. This problem was fixed in server-2024-09-25. Those who follow the tagged releases should update to `server-2024-09-25` or later. Those who follow the rolling tag on DockerHub, `docker pull shieldsio/shields:next` to update to the latest version. As a workaround, blocking access to the endpoints `/badge/dynamic/json`, `/badge/dynamic/toml`, and `/badge/dynamic/yaml` (e.g: via a firewall or reverse proxy in front of your instance) would prevent the exploitable endpoints from being acces
e.g: via a firewall or reverse proxy in front of your instance) would prevent the exploitable endpoints from being accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/badges/shields/security/advisories/GHSA-rxvx-x284-4445 - https://github.com/badges/shields/issues/10553 - https://github.com/badges/shields/pull/10551 - https://github.com/badges/shields/commit/ec1b6c8daccda075403c1688ac02603f7aaa50b2
CVE ID: CVE-2024-47181 State: PUBLISHED Published: 2024-11-27T18:20:41.583Z Last Updated: 2024-11-27T19:20:07.764Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-704 Description: Contiki-NG is an open-source, cross-platform operating system for IoT devices. An unaligned memory access can be triggered in the two RPL implementations of the Contiki-NG operating system. The problem can occur when either one of these RPL implementations is enabled and connected to an RPL instance. If an IPv6 packet containing an odd number of padded bytes before the RPL option, it can cause the rpl_ext_header_hbh_update function t
et containing an odd number of padded bytes before the RPL option, it can cause the rpl_ext_header_hbh_update function to read a 16-bit integer from an odd address. The impact of this unaligned read is architecture-dependent, but can potentially cause the system to crash. The problem has not been patched as of release 4.9, but will be included in the next release. One can apply the changes in Contiki-NG pull request #2962 to patch the system or wait for the next release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-crjw-x84h-h6x3 - https://github.com/contiki-ng/contiki-ng/pull/2962
CVE ID: CVE-2024-47182 State: PUBLISHED Published: 2024-09-27T13:58:22.881Z Last Updated: 2024-09-27T14:13:09.811Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: amir20 Products: dozzle Problem Types: CWE-328 Description: Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35 - https://github.com/amir20/dozzle/com
ences: - https://github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35 - https://github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3
CVE ID: CVE-2024-47183 State: PUBLISHED Published: 2024-10-04T15:06:45.274Z Last Updated: 2024-10-04T15:30:37.224Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-285 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0. Additional Analyst Notes: - CISA ADP Vulnrichme
eges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg - https://github.com/parse-community/parse-server/pull/9317 - https://github.com/parse-community/parse-server/pull/9318 - https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc - https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f
CVE ID: CVE-2024-47184 State: PUBLISHED Published: 2024-09-27T14:05:01.794Z Last Updated: 2024-09-27T16:20:59.445Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ampache Products: ampache Problem Types: CWE-79 Description: Ampache is a web based audio/video streaming application and file manager. Prior to version 6.6.0, the Democratic Playlist Name is vulnerable to a stored cross-site scripting. Version 6.6.0 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ampache/ampache/security/advisories/GHSA-f99r-gv34-v46f - https://github.com/ampache/ampache/commit/7e64d140dafcbe0d61f1a07e94486f6ed67932d6 - https:/
ories/GHSA-f99r-gv34-v46f - https://github.com/ampache/ampache/commit/7e64d140dafcbe0d61f1a07e94486f6ed67932d6 - https://github.com/ampache/ampache/blob/ff332c9810e493fd51b258f5e53119fad86c23bf/public/templates/show_democratic.inc.php#L36