CVE-2026-100847
Last modified
CVE-2026-100847 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings..
Description
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| AzuraCast | AzuraCast | < 0.23.8 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-100847?
How severe is CVE-2026-100847?
How do I fix CVE-2026-100847?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-100841In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) ex…7.8
- CVE-2026-100842MONAI through 1.6.0 contains an eval injection vulnerability…7
- CVE-2026-100843MONAI versions before 1.6.0 contain a remote code execution …7.8
- CVE-2026-100844MONAI before 1.6.0 is vulnerable to OS command injection in …8.4
- CVE-2026-100845MONAI before 1.6.0 contains an unsafe deserialization vulner…7.8
- CVE-2026-100846MONAI before 1.5.2 contains a deserialization of untrusted d…7.6
- CVE-2026-100848AzuraCast (Composer package azuracast/azuracast) before 0.23…7.1
- CVE-2026-100849AzuraCast is a self-hosted web radio management suite. In Az…7.1
- CVE-2026-10085Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.1…5.4
- CVE-2026-100850AzuraCast before 0.23.8 contains a server-side request forge…7.7
- CVE-2026-100851AzuraCast before 0.23.8 contains a broken access control vul…7.6
- CVE-2026-100852AzuraCast through 0.23.x contains a command injection vulner…8.8
Are you affected by CVE-2026-100847?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST