Airsonic Project Airsonic — known CVE vulnerabilities

Every CVE whose affected-product data names Airsonic Project Airsonic, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2018-20222 — CVSS 9.8 (critical): XXE issue in Airsonic before 10.1.2 during parse.
• CVE-2019-10907 — CVSS 9.8 (critical): Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An…
• CVE-2019-10908 — CVSS 9.8 (critical): In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random…