MS
Product
M-Files Server
35
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 13Medium 17Low 2
Watch
Add M-Files Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-10127 | 9.8 | Nov 20 | Support for authentication bypass condition in M-Files LDAP authentication Affected: before 24.8.13981.13; before 24.11 |
| CVE-2023-6912 | 9.8 | Dec 20 | Brute force vulnerability in M-Files user authentication Affected: before 23.12.13205.0 |
| CVE-2021-41807 | 9.8 | Jan 18 | Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and… Affected: before 21.12.10873.0 |
| CVE-2023-6239 | 8.8 | Nov 28 | Incorrect calculation of effective permissions Affected: 23.9; 23.10; 23.11 before 23.11.13168.7 |
| CVE-2023-2112 | 7.8 | Apr 20 | Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0 Affected: before 23.4.12455.0 |
| CVE-2022-4862 | 7.6 | Mar 6 | Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3 Affected: before 22.12.12140.3 |
| CVE-2025-0635 | 7.5 | Jan 23 | Denial of Service condition in M-Files Server Affected: before 25.1.14445.5 |
| CVE-2024-4056 | 7.5 | Apr 26 | Denial of service condition in M-Files Server Affected: 23.11.13168.6 before 24.4.13592 |
| CVE-2023-6117 | 7.5 | Nov 22 | M-Files REST API allows Denial of Service Affected: before 23.11.13156.0 |
| CVE-2023-3405 | 7.5 | Jun 27 | Denial of service condition in M-Files Server Affected: before 23.6.12695.3 |
| CVE-2023-0384 | 7.5 | Apr 20 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job Affected: before 23.4.12528.1 |
| CVE-2023-0383 | 7.5 | Apr 20 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption Affected: before 23.4.12528.1 |
| CVE-2022-3284 | 7.5 | Mar 6 | Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0 Affected: before 22.11.12011.0 |
| CVE-2022-4858 | 7.5 | Dec 30 | Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set Affected: before 22.10.11846.0 |
| CVE-2026-0932 | 7.3 | Apr 1 | Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated… Affected: before 26.3.15818.5 |
| CVE-2025-3086 | 7.1 | Apr 4 | User in anonymous role could create and delete views Affected: before 25.3.14549 |
| CVE-2025-11681 | 6.5 | Nov 17 | Denial of Service condition in M-Files Server Affected: before 25.2.14524.13; before 25.11.15392.1; 25.8.15085.13 before 25.8.15085.17 |
| CVE-2025-5964 | 6.5 | Jun 15 | Path traversal in M-Files API Affected: before 24.8.13981.16; 25.2.14524.3 before 25.2.14524.9; 25.3.14681.7 before 25.6.14925.0 |
| CVE-2024-6789 | 6.5 | Aug 27 | Path traversal in M-Files API Affected: before 24.2.13421.15; before 24.8.13981.0 |
| CVE-2024-0563 | 6.5 | Feb 23 | Denial of service condition in M-Files Server Affected: before 23.2.12340.6; after 23.2.12340.6 before 23.8.12892.6; 23.2.12340.6 before 23.8.12892.17; after 23.8.12892.6 before 24.2.13421.8 |
| CVE-2023-6910 | 6.5 | Dec 20 | Uncontrolled Resource Consumption in M-Files Server Affected: before 23.12.13195.0 |
| CVE-2023-0382 | 6.5 | Apr 5 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption Affected: before 23.4.12528.1 |
| CVE-2023-6189 | 5.3 | Nov 22 | Improper Permission Handling in M-Files Server Affected: before 23.11.13156.0 |
| CVE-2023-3425 | 5.3 | Aug 25 | CVE-2023-3425: Out-of-Bounds memory read Affected: before 23.8.12892.6 |
| CVE-2022-1911 | 5.3 | Nov 30 | Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating… Affected: before 22.6.11534.4 |
| CVE-2026-0663 | 4.9 | Jan 21 | Denial of Service condition in M-Files Server Affected: before 26.1.15632.3 |
| CVE-2025-14267 | 4.9 | Dec 19 | Unintended temporary cached data included in a structure only copy intended to be empty of data Affected: before 25.12.15491.7 |
| CVE-2025-0619 | 4.9 | Jan 23 | Unsafe stored password recovery Affected: before 25.1.14445.5 |
| CVE-2025-0648 | 4.9 | Jan 23 | M-Files Server crash via EOT database driver configuration Affected: before 24.8.13981.14; 24.9.14055.3 before 25.1.14445.5 |
| CVE-2025-14318 | 4.3 | Dec 18 | Improper access validation in M-Files Server Affected: before 25.12.15491.7 |
| CVE-2024-10126 | 4.3 | Nov 20 | Local file inclusion vulnerability in M-Files Server Affected: before 23.8.12892.6; before 23.8.12892.23; 24.2.13421.11 before 24.2.13421.17; 24.8.13981.8 before 24.8.13981.11 |
| CVE-2022-1606 | 4.3 | Nov 30 | Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects Affected: before 22.3.11237.3 |
| CVE-2021-41809 | 4.3 | Jan 18 | SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types… Affected: before 22.1.11017.1 |
| CVE-2022-4270 | 2.6 | Dec 2 | Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally Affected: before 22.5.11436.1 |
| CVE-2021-41808 | 2.3 | Jan 18 | In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log Affected: before 21.11.10775.0 |
Showing 35