Login Request a demo
MF
Vendor
M-Files
9 products with CVEs on record
63
CVEs
0
On KEV
0
New 30D
Products
MS
M-Files Server
M-Files
9.8
35 CVEs0 on KEV0 new
HU
Hubshare
M-Files
8.8
9 CVEs0 on KEV0 new
MW
M-Files Web
M-Files
9.8
6 CVEs0 on KEV0 new
MF
M-files
M-files
9.8
5 CVEs0 on KEV0 new
CW
Classic Web
M-files
6.5
3 CVEs0 on KEV0 new
WC
Web Companion
M-Files
7.8
2 CVEs0 on KEV0 new
MC
M-files Client
M-files
4.9
1 CVEs0 on KEV0 new
MM
M-files Mobile
M-files
5.4
1 CVEs0 on KEV0 new
SE
Server
M-files
4.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-0932
MS
M-files Server
M-files
7.3
0%
Apr 1Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated…
CVE-2026-0663
MS
M-files Server
M-files
4.9
0%
Jan 21Denial of Service condition in M-Files Server
CVE-2025-14267
MS
M-files Server
M-files
4.9
0%
Dec 19Unintended temporary cached data included in a structure only copy intended to be empty of data
CVE-2025-14318
MS
M-files Server
M-files
4.3
0%
Dec 18Improper access validation in M-Files Server
CVE-2025-11681
MS
M-files Server
M-files
6.5
0%
Nov 17Denial of Service condition in M-Files Server
CVE-2025-9826
HU
Hubshare
M-files
5.4
0%
Sep 15Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users
CVE-2025-2091
MM
M-files Mobile
M-files
5.4
0%
Jun 16Open redirection in M-Files Mobile
CVE-2025-5964
MS
M-files Server
M-files
6.5
13%
Jun 15Path traversal in M-Files API
CVE-2025-3087
MW
M-files Web
M-files
5.4
0%
Apr 4Stored XSS Vulnerability in M-Files Web
CVE-2025-3086
MS
M-files Server
M-files
7.1
0%
Apr 4User in anonymous role could create and delete views
CVE-2025-0635
MS
M-files Server
M-files
7.5
1%
Jan 23Denial of Service condition in M-Files Server
CVE-2025-0619
MS
M-files Server
M-files
4.9
0%
Jan 23Unsafe stored password recovery
CVE-2025-0648
MS
M-files Server
M-files
4.9
1%
Jan 23M-Files Server crash via EOT database driver configuration
CVE-2024-10126
MS
M-files Server
M-files
4.3
0%
Nov 20Local file inclusion vulnerability in M-Files Server
CVE-2024-10127
MS
M-files Server
M-files
9.8
1%
Nov 20Support for authentication bypass condition in M-Files LDAP authentication
CVE-2024-9174
HU
Hubshare
M-files
5.4
0%
Oct 2Stored HTML Injection in Hubshare social module
CVE-2024-6789
MS
M-files Server
M-files
6.5
1%
Aug 27Path traversal in M-Files API
CVE-2024-6124
HU
Hubshare
M-files
5.4
0%
Jul 29Reflected XSS in Hubshare via Open Redirect
CVE-2024-6881
HU
Hubshare
M-files
5.4
0%
Jul 29Stored XSS Vulnerability
CVE-2024-5142
HU
Hubshare
M-files
5.4
0%
May 24XSS in Hubshare's social module
CVE-2024-4056
MS
M-files Server
M-files
7.5
1%
Apr 26Denial of service condition in M-Files Server
CVE-2023-4479
MF
M-files
M-files
5.4
0%
Mar 4Stored XSS Vulnerability in M-Files Web
CVE-2024-0563
MS
M-files Server
M-files
6.5
1%
Feb 23Denial of service condition in M-Files Server
CVE-2023-6910
MS
M-files Server
M-files
6.5
1%
Dec 20Uncontrolled Resource Consumption in M-Files Server
CVE-2023-6912
MS
M-files Server
M-files
9.8
1%
Dec 20Brute force vulnerability in M-Files user authentication
CVE-2023-6239
MS
M-Files Server
M-Files
8.8
1%
Nov 28Incorrect calculation of effective permissions
CVE-2023-6189
MS
M-Files Server
M-Files
5.3
1%
Nov 22Improper Permission Handling in M-Files Server
CVE-2023-6117
MS
M-Files Server
M-Files
7.5
1%
Nov 22M-Files REST API allows Denial of Service
CVE-2023-5524
WC
Web Companion
M-Files
7.3
0%
Oct 20M-Files Web Companion allows Remote Code Execution for some filetypes
CVE-2023-5523
WC
Web Companion
M-Files
7.8
0%
Oct 20M-Files Web Companion allows Remote Code Execution
CVE-2023-2325
MW
M-Files Web
M-Files
5.4
1%
Oct 20Stored XSS Vulnerability in M-Files Classic Web
CVE-2023-3406
MW
M-Files Web
M-Files
6.5
1%
Aug 25Path traversal issue in M-Files Classic Web
CVE-2023-3425
MS
M-Files Server
M-Files
5.3
1%
Aug 25CVE-2023-3425: Out-of-Bounds memory read
CVE-2023-3405
MS
M-Files Server
M-Files
7.5
1%
Jun 27Denial of service condition in M-Files Server
CVE-2023-2480
MF
M-files
M-files
7.8
0%
May 25Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications
CVE-2023-2112
MS
M-files Server
M-files
7.8
0%
Apr 20Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0
CVE-2023-0384
MS
M-files Server
M-files
7.5
1%
Apr 20User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job
CVE-2023-0383
MS
M-files Server
M-files
7.5
1%
Apr 20User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption
CVE-2023-0382
MS
M-files Server
M-files
6.5
1%
Apr 5User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption
CVE-2023-0213
MF
M-files
M-files
7.8
0%
Mar 29Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking
CVE-2022-4862
MS
M-files Server
M-files
7.6
0%
Mar 6Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3
CVE-2022-3284
MS
M-files Server
M-files
7.5
1%
Mar 6Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0
CVE-2022-4861
MC
M-files Client
M-files
4.9
1%
Dec 30Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource
CVE-2022-4858
MS
M-files Server
M-files
7.5
0%
Dec 30Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set
CVE-2022-4264
MF
M-files
M-files
4.3
1%
Dec 9Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration
CVE-2022-4270
MS
M-files Server
M-files
2.6
1%
Dec 2Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally
CVE-2022-1911
MS
M-files Server
M-files
5.3
1%
Nov 30Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating…
CVE-2022-1606
MS
M-files Server
M-files
4.3
0%
Nov 30Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects
CVE-2022-39018
HU
Hubshare
M-Files
7.5
1%
Oct 31Broken access controls on PDFtron data in M-Files Hubshare
CVE-2022-39019
HU
Hubshare
M-Files
7.5
0%
Oct 31Broken access controls on PDFtron WebviewerUI in M-Files Hubshare
CVE-2022-39017
HU
Hubshare
M-Files
5.4
0%
Oct 31XSS in all comments fields in M-Files Hubshare
CVE-2022-39016
HU
Hubshare
M-Files
8.8
1%
Oct 31Javascript injection in PDFtron in M-Files Hubshare
CVE-2021-41810
SE
Server
M-files
4.8
1%
May 2Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool
CVE-2021-41809
MS
M-files Server
M-files
4.3
1%
Jan 18SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types…
CVE-2021-41808
MS
M-files Server
M-files
2.3
0%
Jan 18In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log
CVE-2021-41807
MS
M-files Server
M-files
9.8
1%
Jan 18Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and…
CVE-2021-37253
MW
M-files Web
M-files
7.5
3%
Dec 5M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers)
CVE-2021-37254
MW
M-files Web
M-files
7.5
1%
Oct 28In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key…