Threats tagged 'ghsa-642p-47qh-4hhp'

Songloft versions from 2.9.0 up to but not including 2.13.6 contain a hardcoded credentials vulnerability. This flaw allows attackers on the same network segment to authenticate as an administrator using a fixed username and password (admin/admin). Exploiting this vulnerability enables unauthorized modification of library and configuration settings and installation of JavaScript plugins executed in QuickJS.