What is CVE-2026-50231?

CVE-2026-50231 is a high-severity vulnerability, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-06-05.

How severe is CVE-2026-50231?

High severity. CVSS v3 base score is 7.2 out of 10.

CVE-2026-50231

CVE-2026-50231

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to execute arbitrary scripts in users' browsers.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (7.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (third-party-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-50231?: CVE-2026-50231 is a high-severity vulnerability, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-06-05.
How severe is CVE-2026-50231?: High severity. CVSS v3 base score is 7.2 out of 10.