Read the docs

M-Files Corporation

Records66All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high32CVSS 7.0–8.9

Exploited now

M-Files Corporation records in CISA KEV

No M-Files Corporation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
M-files Server 34 records MEDIUM Hubshare 9 records LOW M-files 4 records LOW M-files Web 4 records HIGH Classic Web 3 records LOW Web Companion 2 records LOW M-files Client 1 record LOW M-files Mobile 1 record LOW

Records

9 records in Hubshare · all components

TI-2022-18408 CVE-2022-39016 · GHSA-ffj3-j67f-53c8

Improper input validation in M-Files Corporation Hubshare

Priority LOW 39

Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00659 Published 2022-10-31 No fix listed CWE-20
TI-2024-06382 CVE-2024-6881 · GHSA-88qp-7q8w-jhw6

Stored XSS in M-Files Corporation Hubshare

Priority LOW 37

Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00349 Published 2024-07-29 Fixed in 5.0.6.0 CWE-79
TI-2024-05675 CVE-2024-6124 · GHSA-vf38-34c2-p6j8

Reflected XSS in Hubshare via Open Redirect

Priority LOW 37

Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00305 Published 2024-07-29 Fixed in 5.0.6.0 CWE-79
TI-2022-18410 CVE-2022-39018 · GHSA-qp9r-pfqf-hxf3

Information disclosure in M-Files Corporation Hubshare

Priority LOW 36

Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00523 Published 2022-10-31 No fix listed CWE-200
TI-2022-18409 CVE-2022-39017 · GHSA-w826-hvm4-82xh

XSS in all comments fields in M-Files Hubshare

Priority LOW 36

Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00443 Published 2022-10-31 No fix listed CWE-20
TI-2022-18411 CVE-2022-39019 · GHSA-hc73-59hp-rq5m

Improper authentication in M-Files Corporation Hubshare

Priority LOW 33

Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00447 Published 2022-10-31 No fix listed CWE-287
TI-2024-04775 CVE-2024-5142

XSS in Hubshare's social module

Priority LOW 31

Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00306 Published 2024-05-24 Fixed in 5.0.6.0 CWE-79
TI-2025-09014 CVE-2025-9826 · GHSA-x6wm-h4q7-p8hv

Cross-site scripting in M-Files Corporation Hubshare

Priority LOW 30

Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00261 Published 2025-09-15 Fixed in 25.8 CWE-79
TI-2024-08517 CVE-2024-9174 · GHSA-96w8-fcjx-v927

Stored HTML Injection in Hubshare social module

Priority LOW 30

Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00293 Published 2024-10-02 Fixed in 5.0.8.6 CWE-79
Open these records in search →