# cve.now: M-files Corporation

The newest entries naming M-files Corporation as an affected vendor (up to 200), of 64 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-18372](https://cve.now/CVE-2026-18372.md): CSS injection in M-Files Web (CVSS 4.8)
- [CVE-2026-18371](https://cve.now/CVE-2026-18371.md): HTML injection in M-Files Web (CVSS 5.1)
- [CVE-2026-0931](https://cve.now/CVE-2026-0931.md): Denial-of-service vulnerability in M-Files Server (CVSS 6.9)
- [CVE-2026-0983](https://cve.now/CVE-2026-0983.md): Denial of service vulnerability in M-Files Server (CVSS 7.1)
- [CVE-2026-0932](https://cve.now/CVE-2026-0932.md): Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server befo (CVSS 6.9)
- [CVE-2026-0663](https://cve.now/CVE-2026-0663.md): Denial of Service condition in M-Files Server (CVSS 6.9)
- [CVE-2025-13008](https://cve.now/CVE-2025-13008.md): Session Token Disclosure in M-Files Web (CVSS 8.6)
- [CVE-2025-14267](https://cve.now/CVE-2025-14267.md): Unintended temporary cached data included in a structure only copy intended to be empty of data (CVSS 5.6)
- [CVE-2025-14318](https://cve.now/CVE-2025-14318.md): Improper access validation in M-Files Server (CVSS 5.3)
- [CVE-2025-11681](https://cve.now/CVE-2025-11681.md): Denial of Service condition in M-Files Server (CVSS 7.1)
- [CVE-2025-9826](https://cve.now/CVE-2025-9826.md): Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution f (CVSS 7.0)
- [CVE-2025-2091](https://cve.now/CVE-2025-2091.md): Open redirection in M-Files Mobile (CVSS 4.8)
- [CVE-2025-5964](https://cve.now/CVE-2025-5964.md): Path traversal in M-Files API (CVSS 8.4)
- [CVE-2025-3087](https://cve.now/CVE-2025-3087.md): Stored XSS Vulnerability in M-Files Web (CVSS 5.1)
- [CVE-2025-3086](https://cve.now/CVE-2025-3086.md): User in anonymous role could create and delete views (CVSS 6.3)
- [CVE-2025-2159](https://cve.now/CVE-2025-2159.md): Stored XSS in M-Files Admin user interface (CVSS 5.1)
- [CVE-2025-0635](https://cve.now/CVE-2025-0635.md): Denial of Service condition in M-Files Server (CVSS 6.3)
- [CVE-2025-0619](https://cve.now/CVE-2025-0619.md): Unsafe stored password recovery (CVSS 4.6)
- [CVE-2025-0648](https://cve.now/CVE-2025-0648.md): M-Files Server crash via EOT database driver configuration (CVSS 5.9)
- [CVE-2024-10126](https://cve.now/CVE-2024-10126.md): Local file inclusion vulnerability in M-Files Server (CVSS 5.3)
- [CVE-2024-10127](https://cve.now/CVE-2024-10127.md): Support for authentication bypass condition in M-Files LDAP authentication (CVSS 9.2)
- [CVE-2024-11176](https://cve.now/CVE-2024-11176.md): Incorrect evaluation of effective permissions in M-Files Aino (CVSS 5.3)
- [CVE-2024-9333](https://cve.now/CVE-2024-9333.md): Permission bypass in M-Files Connector for Copilot (CVSS 5.3)
- [CVE-2024-9174](https://cve.now/CVE-2024-9174.md): Stored HTML Injection in Hubshare social module (CVSS 6.9)
- [CVE-2024-6789](https://cve.now/CVE-2024-6789.md): Path traversal in M-Files API (CVSS 8.4)
- [CVE-2024-6124](https://cve.now/CVE-2024-6124.md): Reflected XSS in Hubshare via Open Redirect (CVSS 8.5)
- [CVE-2024-6881](https://cve.now/CVE-2024-6881.md): Stored XSS Vulnerability (CVSS 8.5)
- [CVE-2024-5142](https://cve.now/CVE-2024-5142.md): XSS in Hubshare's social module (CVSS 7.0)
- [CVE-2024-4056](https://cve.now/CVE-2024-4056.md): Denial of service condition in M-Files Server (CVSS 7.5)
- [CVE-2023-4479](https://cve.now/CVE-2023-4479.md): Stored XSS Vulnerability in M-Files Web (CVSS 7.3)
- [CVE-2024-0563](https://cve.now/CVE-2024-0563.md): Denial of service condition in M-Files Server (CVSS 4.3)
- [CVE-2023-6910](https://cve.now/CVE-2023-6910.md): Uncontrolled Resource Consumption in M-Files Server (CVSS 6.5)
- [CVE-2023-6912](https://cve.now/CVE-2023-6912.md): Brute force vulnerability in M-Files user authentication (CVSS 7.5)
- [CVE-2023-6239](https://cve.now/CVE-2023-6239.md): Incorrect calculation of effective permissions (CVSS 5.4)
- [CVE-2023-6189](https://cve.now/CVE-2023-6189.md): Improper Permission Handling in M-Files Server (CVSS 4.3)
- [CVE-2023-6117](https://cve.now/CVE-2023-6117.md): M-Files REST API allows Denial of Service (CVSS 5.7)
- [CVE-2023-5524](https://cve.now/CVE-2023-5524.md): M-Files Web Companion allows Remote Code Execution for some filetypes (CVSS 8.2)
- [CVE-2023-5523](https://cve.now/CVE-2023-5523.md): M-Files Web Companion allows Remote Code Execution (CVSS 8.6)
- [CVE-2023-2325](https://cve.now/CVE-2023-2325.md): Stored XSS Vulnerability in M-Files Classic Web (CVSS 7.3)
- [CVE-2023-3406](https://cve.now/CVE-2023-3406.md): Path traversal issue in M-Files Classic Web (CVSS 7.7)
- [CVE-2023-3425](https://cve.now/CVE-2023-3425.md): CVE-2023-3425: Out-of-Bounds memory read (CVSS 6.5)
- [CVE-2023-3405](https://cve.now/CVE-2023-3405.md): Denial of service condition in M-Files Server (CVSS 7.5)
- [CVE-2023-2480](https://cve.now/CVE-2023-2480.md): Elevation of Privilege in M-Files Desktop Client (CVSS 7.5)
- [CVE-2023-2112](https://cve.now/CVE-2023-2112.md): Desktop component allows lateral movement between sessions (CVSS 3.6)
- [CVE-2023-0384](https://cve.now/CVE-2023-0384.md): Uncontrolled Resource Consuption in M-Files Server (CVSS 6.5)
- [CVE-2023-0383](https://cve.now/CVE-2023-0383.md): Uncontrolled Resource Consuption in M-Files Server (CVSS 7.5)
- [CVE-2023-0382](https://cve.now/CVE-2023-0382.md): Uncontrolled Resource Consumption in M-Files Server (CVSS 6.5)
- [CVE-2023-0213](https://cve.now/CVE-2023-0213.md): Local Elevation of Privilege in M-Files (CVSS 8.8)
- [CVE-2022-4862](https://cve.now/CVE-2022-4862.md): XSS vulnerability in M-Files Web (CVSS 5.0)
- [CVE-2022-3284](https://cve.now/CVE-2022-3284.md): Insecure way of passing a download key (CVSS 6.5)
- [CVE-2022-4861](https://cve.now/CVE-2022-4861.md): Incorrect Implementation of Authentication Algorithm (CVSS 4.8)
- [CVE-2022-4858](https://cve.now/CVE-2022-4858.md): Insertion of Sensitive Information into Log File (CVSS 4.4)
- [CVE-2022-4264](https://cve.now/CVE-2022-4264.md): Incorrect privilege assignment in M-Files Web Server (CVSS 6.5)
- [CVE-2022-4270](https://cve.now/CVE-2022-4270.md): Incorrect privilege assignment in M-Files Web Server (CVSS 2.0)
- [CVE-2022-1911](https://cve.now/CVE-2022-1911.md): Information disclosure in M-Files Server (CVSS 5.3)
- [CVE-2022-1606](https://cve.now/CVE-2022-1606.md): Incorrect privilege assignment in M-Files Server (CVSS 2.4)
- [CVE-2022-39018](https://cve.now/CVE-2022-39018.md): Broken access controls on PDFtron data in M-Files Hubshare (CVSS 8.2)
- [CVE-2022-39019](https://cve.now/CVE-2022-39019.md): Broken access controls on PDFtron WebviewerUI in M-Files Hubshare (CVSS 6.3)
- [CVE-2022-39017](https://cve.now/CVE-2022-39017.md): XSS in all comments fields in M-Files Hubshare (CVSS 8.2)
- [CVE-2022-39016](https://cve.now/CVE-2022-39016.md): Javascript injection in PDFtron in M-Files Hubshare (CVSS 8.2)
- [CVE-2021-41810](https://cve.now/CVE-2021-41810.md): Script injection in M-Files Admin (CVSS 5.2)
- [CVE-2021-41808](https://cve.now/CVE-2021-41808.md): In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs. (CVSS 2.0)
- [CVE-2021-41807](https://cve.now/CVE-2021-41807.md): Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts. (CVSS 7.5)
- [CVE-2021-41809](https://cve.now/CVE-2021-41809.md): SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server. (CVSS 3.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/m-files
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.