CVE-2026-50235

MEDIUM

Lyrion Music Server 9.2.0 Reflected XSS via search Parameters

Title source: cna

Description

Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attackers can inject malicious scripts through unfiltered search parameters to execute arbitrary JavaScript in users' browsers and steal session information.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory

Zero Science Lab Disclosure

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5993.php

Third Party Advisory third-party-advisory

VulnCheck Advisory: Lyrion Music Server 9.2.0 Reflected XSS via search Parameters

https://www.vulncheck.com/advisories/lyrion-music-server-reflected-xss-via-search-parameters

Scores

CVSS v3 6.1

EPSS 0.0016

EPSS Percentile 5.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

LMS Community/Lyrion Music Server 9.2.0

Published Jun 05, 2026

Tracked Since Jun 05, 2026