TI-2020-16372 CVE-2020-26948 · GHSA-cw27-8cg2-49c9
Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.
Priority HIGH 84
Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.
Emby
Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
Emby records in CISA KEVNo Emby vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Emby · all components
TI-2021-07880 CVE-2021-25827 · GHSA-m4q9-68f2-5wc6
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the…
Priority HIGH 82
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
TI-2025-39760 CVE-2025-64325
Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard
Priority HIGH 72
Emby Server is a personal media server.
TI-2022-16600 CVE-2022-36223 · GHSA-w66w-cmgq-cc2j
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is…
Priority MEDIUM 60
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.
TI-2025-39564 CVE-2025-64113
Emby Server allows attackers to gain administrative server access without preconditions
Priority MEDIUM 49
Emby Server is a user-installable home media server.
TI-2021-07881 CVE-2021-25828 · GHSA-9pjf-87x2-r68m
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability…
Priority LOW 28
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.