What is GHSA-hv9j-9524-hrq6?

GHSA-hv9j-9524-hrq6 is a security advisory published by GitHub Security Advisories with High severity. AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of...

Which CVE IDs does GHSA-hv9j-9524-hrq6 cover?

GHSA-hv9j-9524-hrq6 covers the following CVE IDs: CVE-2026-100847. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hv9j-9524-hrq6?

GHSA-hv9j-9524-hrq6 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-hv9j-9524-hrq6HighCVSS 7.5

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of...

Vendor

GitHub Security Advisories

Published

September 27, 2026

Last Modified

September 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-100847 →

📋 Description

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.

🔗 References (4)

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-jqwc-h3rq-frmw
https://nvd.nist.gov/vuln/detail/CVE-2026-100847
https://www.vulncheck.com/advisories/azuracast-before-0.23.8-dql-injection-via-sortorder
https://github.com/advisories/GHSA-hv9j-9524-hrq6