GCVE - cpe:2.3:a:lynxtechnology:twonky

Approved changes feed: RSS · Atom

cpe:2.3:a:lynxtechnology:twonky_server:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Lynxtechnology (`cc0e3e16-fdc0-544d-9d56-76c235685d81`)
Product	Twonky Server (`97ece725-4e71-51ee-9ea8-644878ee8815`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/dtjs48jkt/twonkyserver`	purl2cpe	2026-06-01 10:15:15.938457
`pkg:github/h2ck/twonkyserver`	purl2cpe	2026-06-01 10:15:15.938460

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-13316`	vulnerable	2026-06-08 07:04:31.992953	Hard-coded encryption keys in Twonky Server Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server. Published: 2025-11-19T17:53:42.934Z Updated: 2025-11-19T18:19:43.388Z Open on db.gcve.eu Reference links https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-13315`	vulnerable	2026-06-08 07:04:31.991492	Unauthenticated log access in Twonky Server Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password. Published: 2025-11-19T17:41:36.996Z Updated: 2025-11-19T18:20:50.718Z Open on db.gcve.eu Reference links https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9182`	vulnerable	2026-06-08 05:12:07.910173	Details available Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section. Published: 2018-06-08T01:00:00.000Z Updated: 2024-08-05T07:17:51.678Z Open on db.gcve.eu Reference links https://gist.github.com/priyanksethi/08fb93341cf7e61344aad5c4fee3aa9b	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9177`	vulnerable	2026-06-08 05:12:07.909671	Details available Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen. Published: 2018-06-08T01:00:00.000Z Updated: 2024-08-05T07:17:51.575Z Open on db.gcve.eu Reference links https://gist.github.com/prafagr/bd641fcfe71661065e659672c737173b	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-7203`	vulnerable	2026-06-08 05:11:55.163726	Details available Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/set_all. Published: 2018-03-30T21:00:00.000Z Updated: 2024-08-05T06:24:11.595Z Open on db.gcve.eu Reference links http://packetstormsecurity.com/files/146939/TwonkyMedia-Server-7.0.11-8.5-Cross-Site-Scripting.html https://www.exploit-db.com/exploits/44351/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-7171`	vulnerable	2026-06-08 05:11:55.102073	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Twonky Server

Notes

PURL mappings

Vulnerability references

Contribute