The vulnerability is a reflected cross‑site scripting flaw in the advanced search feature of Lyrion Music Server 9.2.0. Search parameters are displayed back to the user without proper escaping, enabling an attacker to inject and execute arbitrary JavaScript in a victim’s browser. This can lead to theft of session cookies, defacement or redirecting users to malicious sites. The flaw is a classic input validation weakness (CWE‑79).

The only version explicitly mentioned as vulnerable is Lyrion Music Server 9.2.0, part of the LMS Community edition. No other versions or editions are noted in the advisory.

The advisory assigns a CVSS score of 5.1, indicating a moderate impact, and there is no EPSS score available, so the exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Attackers need only supply a specially crafted search URL or form submission that contains malicious script; the flaw is reflected immediately in the response presented to the user. If a user opens the crafted link in a browser, the attacker can acquire the victim's session cookies or other sensitive browser data.