Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: M-Files Corporation Component: Hubshare Clear all filters
TI-2025-09014 CVE-2025-9826 · GHSA-x6wm-h4q7-p8hv

Cross-site scripting in M-Files Corporation Hubshare

Priority LOW 30

Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00261 Published 2025-09-15 Fixed in 25.8 CWE-79
TI-2024-08517 CVE-2024-9174 · GHSA-96w8-fcjx-v927

Stored HTML Injection in Hubshare social module

Priority LOW 30

Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00293 Published 2024-10-02 Fixed in 5.0.8.6 CWE-79
TI-2024-05675 CVE-2024-6124 · GHSA-vf38-34c2-p6j8

Reflected XSS in Hubshare via Open Redirect

Priority LOW 37

Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00305 Published 2024-07-29 Fixed in 5.0.6.0 CWE-79
TI-2024-06382 CVE-2024-6881 · GHSA-88qp-7q8w-jhw6

Stored XSS in M-Files Corporation Hubshare

Priority LOW 37

Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00349 Published 2024-07-29 Fixed in 5.0.6.0 CWE-79
TI-2024-04775 CVE-2024-5142

XSS in Hubshare's social module

Priority LOW 31

Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00306 Published 2024-05-24 Fixed in 5.0.6.0 CWE-79
TI-2022-18410 CVE-2022-39018 · GHSA-qp9r-pfqf-hxf3

Information disclosure in M-Files Corporation Hubshare

Priority LOW 36

Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00523 Published 2022-10-31 No fix listed CWE-200
TI-2022-18411 CVE-2022-39019 · GHSA-hc73-59hp-rq5m

Improper authentication in M-Files Corporation Hubshare

Priority LOW 33

Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00447 Published 2022-10-31 No fix listed CWE-287
TI-2022-18409 CVE-2022-39017 · GHSA-w826-hvm4-82xh

XSS in all comments fields in M-Files Hubshare

Priority LOW 36

Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments.

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00443 Published 2022-10-31 No fix listed CWE-20
TI-2022-18408 CVE-2022-39016 · GHSA-ffj3-j67f-53c8

Improper input validation in M-Files Corporation Hubshare

Priority LOW 39

Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00659 Published 2022-10-31 No fix listed CWE-20