Medium severity · published Apr 4, 2025
CVE-2025-2159
Stored XSS in M-Files Admin user interface
5.1
CVSS
0.2%
EPSS
No
On KEV
Description
Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
M-Files Admin · M-Files Corporation
before 25.3.14681.7 · source: vendor