https://vulnogram.org/ Most recent CVEs assigned by m-files_corporation (m-files_corporation). https://vulnogram.org/seaview/icons/m-files_corporation.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-18372 https://vulnogram.org/CVE-2026-18372 CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users. Medium Wed, 19 Aug 2026 11:47:07 GMT https://vulnogram.org/CVE-2026-18371 https://vulnogram.org/CVE-2026-18371 HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users. Medium Wed, 19 Aug 2026 11:46:55 GMT https://vulnogram.org/CVE-2026-0931 https://vulnogram.org/CVE-2026-0931 Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart. Medium Wed, 05 Aug 2026 09:42:23 GMT https://vulnogram.org/CVE-2026-0983 https://vulnogram.org/CVE-2026-0983 Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash High Mon, 18 May 2026 11:05:29 GMT https://vulnogram.org/CVE-2026-0932 https://vulnogram.org/CVE-2026-0932 Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs. Medium Network Exploitable Wed, 01 Apr 2026 10:03:27 GMT https://vulnogram.org/CVE-2026-0663 https://vulnogram.org/CVE-2026-0663 Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash the M-Files Server process by calling a vulnerable API endpoint. Medium Wed, 21 Jan 2026 10:29:57 GMT https://vulnogram.org/CVE-2025-13008 https://vulnogram.org/CVE-2025-13008 An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users. High Fri, 19 Dec 2025 07:04:19 GMT https://vulnogram.org/CVE-2025-14267 https://vulnogram.org/CVE-2025-14267 Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7 Medium Fri, 19 Dec 2025 06:15:09 GMT https://vulnogram.org/CVE-2025-14318 https://vulnogram.org/CVE-2025-14318 Improper access checks in M-Files Server before 25.12.15491.7 allows users to download files through M-Files Web using Web Companion despite Print and Download Prevention module being enabled. Medium Thu, 18 Dec 2025 07:32:34 GMT https://vulnogram.org/CVE-2025-11681 https://vulnogram.org/CVE-2025-11681 Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash. High Mon, 17 Nov 2025 11:30:25 GMT https://vulnogram.org/CVE-2025-9826 https://vulnogram.org/CVE-2025-9826 Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. High Mon, 15 Sep 2025 10:15:15 GMT https://vulnogram.org/CVE-2025-2091 https://vulnogram.org/CVE-2025-2091 An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs. Medium Mon, 16 Jun 2025 08:27:13 GMT https://vulnogram.org/CVE-2025-5964 https://vulnogram.org/CVE-2025-5964 A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server. High Sun, 15 Jun 2025 19:42:24 GMT https://vulnogram.org/CVE-2025-3087 https://vulnogram.org/CVE-2025-3087 Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts Medium Fri, 04 Apr 2025 06:40:07 GMT https://vulnogram.org/CVE-2025-3086 https://vulnogram.org/CVE-2025-3086 Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial of service Medium Network Exploitable Fri, 04 Apr 2025 06:37:42 GMT https://vulnogram.org/CVE-2025-2159 https://vulnogram.org/CVE-2025-2159 Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI Medium Fri, 04 Apr 2025 06:06:48 GMT https://vulnogram.org/CVE-2025-0635 https://vulnogram.org/CVE-2025-0635 Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions. Medium Network Exploitable Thu, 23 Jan 2025 11:07:51 GMT https://vulnogram.org/CVE-2025-0619 https://vulnogram.org/CVE-2025-0619 Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords Medium Thu, 23 Jan 2025 11:07:10 GMT https://vulnogram.org/CVE-2025-0648 https://vulnogram.org/CVE-2025-0648 Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change. Medium Thu, 23 Jan 2025 11:06:19 GMT https://vulnogram.org/CVE-2024-10126 https://vulnogram.org/CVE-2024-10126 Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read server local files of a limited set of filetypes via document preview. Medium Wed, 20 Nov 2024 08:37:41 GMT https://vulnogram.org/CVE-2024-10127 https://vulnogram.org/CVE-2024-10127 Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a password when the LDAP server itself had the vulnerable configuration… Critical Network Exploitable Wed, 20 Nov 2024 08:36:03 GMT https://vulnogram.org/CVE-2024-11176 https://vulnogram.org/CVE-2024-11176 Improper access control vulnerability in M-Files Aino in versions before 24.10 allowed an authenticated user to access object information via incorrect evaluation of effective permissions. Medium Cloud Hosted Wed, 20 Nov 2024 08:33:45 GMT https://vulnogram.org/CVE-2024-9333 https://vulnogram.org/CVE-2024-9333 Permissions bypass in M-Files Connector for Copilot before version 24.9.3 allows authenticated user to access limited amount of documents via incorrect access control list calculation Medium Wed, 02 Oct 2024 05:57:40 GMT https://vulnogram.org/CVE-2024-9174 https://vulnogram.org/CVE-2024-9174 Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI Medium Wed, 02 Oct 2024 05:56:28 GMT https://vulnogram.org/CVE-2024-6789 https://vulnogram.org/CVE-2024-6789 A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 allows authenticated user to read files High Tue, 27 Aug 2024 09:57:00 GMT https://vulnogram.org/CVE-2024-6124 https://vulnogram.org/CVE-2024-6124 Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session High Network Exploitable Mon, 29 Jul 2024 13:00:33 GMT https://vulnogram.org/CVE-2024-6881 https://vulnogram.org/CVE-2024-6881 Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session High Mon, 29 Jul 2024 12:56:51 GMT https://vulnogram.org/CVE-2024-5142 https://vulnogram.org/CVE-2024-5142 Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser High Fri, 24 May 2024 05:58:41 GMT https://vulnogram.org/CVE-2024-4056 https://vulnogram.org/CVE-2024-4056 Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computing resources. High Network Exploitable Fri, 26 Apr 2024 06:02:21 GMT https://vulnogram.org/CVE-2023-4479 https://vulnogram.org/CVE-2023-4479 Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document within limited time period. High Mon, 04 Mar 2024 07:17:20 GMT https://vulnogram.org/CVE-2024-0563 https://vulnogram.org/CVE-2024-0563 Denial of service condition in M-Files Server in versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service against other anonymous users. Medium Fri, 23 Feb 2024 08:52:38 GMT https://vulnogram.org/CVE-2023-6910 https://vulnogram.org/CVE-2023-6910 A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests. Medium Wed, 20 Dec 2023 09:36:39 GMT https://vulnogram.org/CVE-2023-6912 https://vulnogram.org/CVE-2023-6912 Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords. High Network Exploitable Wed, 20 Dec 2023 09:35:46 GMT https://vulnogram.org/CVE-2023-6239 https://vulnogram.org/CVE-2023-6239 Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentiall… Medium Tue, 28 Nov 2023 14:07:20 GMT https://vulnogram.org/CVE-2023-6189 https://vulnogram.org/CVE-2023-6189 Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods. Medium Wed, 22 Nov 2023 09:56:44 GMT https://vulnogram.org/CVE-2023-6117 https://vulnogram.org/CVE-2023-6117 A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks. Medium Wed, 22 Nov 2023 09:56:32 GMT https://vulnogram.org/CVE-2023-5524 https://vulnogram.org/CVE-2023-5524 Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types High Fri, 20 Oct 2023 06:41:56 GMT https://vulnogram.org/CVE-2023-5523 https://vulnogram.org/CVE-2023-5523 Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution High Fri, 20 Oct 2023 06:40:29 GMT https://vulnogram.org/CVE-2023-2325 https://vulnogram.org/CVE-2023-2325 Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document. High Fri, 20 Oct 2023 06:39:44 GMT https://vulnogram.org/CVE-2023-3406 https://vulnogram.org/CVE-2023-3406 Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server High Fri, 25 Aug 2023 08:11:46 GMT https://vulnogram.org/CVE-2023-3425 https://vulnogram.org/CVE-2023-3425 Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory. Medium Network Exploitable Fri, 25 Aug 2023 08:08:05 GMT https://vulnogram.org/CVE-2023-3405 https://vulnogram.org/CVE-2023-3405 Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service High Network Exploitable Tue, 27 Jun 2023 14:24:40 GMT https://vulnogram.org/CVE-2023-2480 https://vulnogram.org/CVE-2023-2480 Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications High Thu, 25 May 2023 13:28:29 GMT https://vulnogram.org/CVE-2023-2112 https://vulnogram.org/CVE-2023-2112 Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. Low Thu, 20 Apr 2023 08:05:52 GMT https://vulnogram.org/CVE-2023-0384 https://vulnogram.org/CVE-2023-0384 User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job. Medium Thu, 20 Apr 2023 08:02:10 GMT https://vulnogram.org/CVE-2023-0383 https://vulnogram.org/CVE-2023-0383 User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. High Network Exploitable Thu, 20 Apr 2023 08:00:31 GMT https://vulnogram.org/CVE-2023-0382 https://vulnogram.org/CVE-2023-0382 User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. Medium Wed, 05 Apr 2023 06:13:59 GMT https://vulnogram.org/CVE-2023-0213 https://vulnogram.org/CVE-2023-0213 Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking. High Wed, 29 Mar 2023 10:22:45 GMT https://vulnogram.org/CVE-2022-4862 https://vulnogram.org/CVE-2022-4862 Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3. Medium Mon, 06 Mar 2023 10:46:20 GMT https://vulnogram.org/CVE-2022-3284 https://vulnogram.org/CVE-2022-3284 Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0. Medium Mon, 06 Mar 2023 10:39:43 GMT