CVE-2026-100847
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of…
- Risk score
- 63/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.
- Affected
- See advisory
- Fix
- Upgrade the product to 0.23.8 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: php
References
Original description
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.
Last activity 27 Sep 2026. Patch Forecast updates every hour.