Approved changes feed: RSS · Atom
cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Getid3 (d86c3676-330d-53ea-b8ab-3c06b3d095cf) |
|---|---|
| Product | Getid3 (6f8a3a43-a756-567e-849b-159ac443e474) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/php-getid3 |
purl2cpe | 2026-06-01 10:16:44.998123 |
pkg:deb/ubuntu/php-getid3 |
purl2cpe | 2026-06-01 10:16:44.998126 |
pkg:github/jamesheinrich/getid3 |
purl2cpe | 2026-06-01 10:16:44.998129 |
pkg:rpm/fedora/php-getid3 |
purl2cpe | 2026-06-01 10:16:44.998131 |
pkg:rpm/opensuse/php-getid3 |
purl2cpe | 2026-06-01 10:16:44.998134 |
pkg:sourceforge/getid3 |
purl2cpe | 2026-06-01 10:16:44.998137 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-94108 |
vulnerable | 2026-10-13 12:28:38.895446 |
getID3 through 1.9.26 XML External Entity Injection via XML2array
MEDIUM (6.5)
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Published: 2026-09-20T11:09:41.588Z
Updated: 2026-09-21T15:11:37.792Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94106 |
vulnerable | 2026-10-13 12:28:38.769666 |
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
HIGH (8.8)
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
Published: 2026-09-20T11:09:40.215Z
Updated: 2026-09-21T20:46:46.047Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-40926 |
vulnerable | 2026-06-08 05:35:19.369441 |
Details available
Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.
Published: 2021-10-01T15:42:09.000Z
Updated: 2024-08-04T02:59:30.956Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-2053 |
vulnerable | 2026-06-08 05:05:27.442198 |
Details available
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Published: 2014-06-04T14:00:00.000Z
Updated: 2024-08-06T09:58:16.348Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.