security@m-files.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@m-files.com
03
assessed vulnerabilities (60)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-18372US | — | — | ||
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to ot… | ||||
| CVE-2026-18371US | — | — | ||
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users. | ||||
| CVE-2026-0931US | — | — | ||
Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart. | ||||
| CVE-2026-0983US | — | — | ||
Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to c… | ||||
| CVE-2026-0932US | high7.3 | — | ||
Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacke… | ||||
| CVE-2026-0663US | medium4.9 | — | ||
Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash the M-Files Server proc… | ||||
| CVE-2025-14267US | medium4.9 | — | ||
Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7 | ||||
| CVE-2025-13008US | — | — | ||
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files… | ||||
| CVE-2025-14318US | medium4.3OT elevated | — | ||
Improper access checks in M-Files Server before 25.12.15491.7 allows users to download files through M-Files Web using Web Companion despite Print and Download Prevention module be… | ||||
| CVE-2025-11681US | medium6.5 | — | ||
Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process… | ||||
| CVE-2025-9826US | medium5.4 | — | ||
Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. | ||||
| CVE-2025-2091US | medium5.4 | — | ||
An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other us… | ||||
| CVE-2025-5964US | medium6.5 | Exploit | ||
A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server. | ||||
| CVE-2025-3087US | medium5.4 | — | ||
Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts | ||||
| CVE-2025-3086US | high7.1 | — | ||
Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial of service | ||||
| CVE-2025-2159US | — | — | ||
Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI | ||||
| CVE-2025-0648US | medium4.9 | — | ||
Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configu… | ||||
| CVE-2025-0635US | high7.5 | — | ||
Denial of service condition in M-Files Server in versions before
25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions. | ||||
| CVE-2025-0619US | medium4.9 | — | ||
Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords | ||||
| CVE-2024-11176US | —OT elevated | — | ||
Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective perm… | ||||