Vulnerability · Published Jun 5, 2026 · Assigned by VulnCheck

CVE-2026-50230Lyrion Music Server 9.2.0 Reflected XSS via server.log

Medium 6.1

In plain English

A medium-severity cross-site scripting in Lyrion Music Server from LMS Community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 64.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log endpoint that allows attackers to inject arbitrary HTML and JavaScript code through the search parameter. Attackers can craft malicious URLs with JavaScript payloads in the search parameter to execute code in users' browsers within the context of the affected application.

Affected products (as reported)

Vendor	Product	Versions
LMS Community	Lyrion Music Server	9.2.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Zero Science Lab Disclosure third-party-advisory
VulnCheck Advisory: Lyrion Music Server 9.2.0 Reflected XSS via server.log third-party-advisory