Emby records
10 published records for vendor emby.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 1 · 10%
- Pre-auth RCE
- 0
- With a fix record
- 20%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5
- CWE-290 Authentication Bypass by Spoofing1
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')1
- CWE-552 Files or Directories Accessible to External Parties1
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password1
- CWE-918 Server-Side Request Forgery (SSRF)1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
10 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
65This week | CVE-2020-26948Weaponized | Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.emby · emby · CWE-918 | Critical9.8 | — | 87.1% | Oct 10, 2020 |
39Monitor | CVE-2021-25827No exploit | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.emby · emby · CWE-290 | Critical9.8 | — | 1.4% | Jun 28, 2023 |
37Monitor | CVE-2023-33193Proof of concept | Emby Server Proxy Header Spoofing Vulnerabilityemby · emby.releases · CWE-444 | Critical9.1 | — | 1.6% | May 30, 2023 |
37Monitor | CVE-2025-64113No exploit | Emby Server allows attackers to gain administrative server access without preconditionsemby · emby · CWE-640 | Critical9.3 | — | 0.5% | Dec 9, 2025 |
34Monitor | CVE-2021-32833No exploit | Unauthenticated file read in Emby Serveremby · emby.releases · CWE-552 | High8.6 | — | 1.2% | Sep 8, 2021 |
33Monitor | CVE-2025-64325No exploit | Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboardemby · emby · CWE-79 | High8.4 | — | 0.4% | Nov 18, 2025 |
24Monitor | CVE-2023-4167No exploit | Media Browser Emby Server cross site scriptingemby · emby.releases · CWE-79 | Medium6.1 | — | 0.6% | Aug 5, 2023 |
24Monitor | CVE-2021-25828No exploit | Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.emby · emby · CWE-79 | Medium6.1 | — | 0.5% | Jun 28, 2023 |
24Monitor | CVE-2022-36223No exploit | In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token andemby · emby · CWE-79 | Medium6.1 | — | 0.4% | Dec 16, 2022 |
24Monitor | CVE-2024-30931No exploit | Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges viaCWE-79 | Medium6.1 | — | 0.3% | Jun 25, 2024 |
- CVE-2020-2694865This week
Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.
CriticalCVSS 9.8WeaponizedEPSS 87%emby · embyOct 10, 2020
- CVE-2021-2582739Monitor
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
CriticalCVSS 9.8No exploitEPSS 1%emby · embyJun 28, 2023
- CVE-2023-3319337Monitor
Emby Server Proxy Header Spoofing Vulnerability
CriticalCVSS 9.1Proof of conceptEPSS 1%emby · emby.releasesMay 30, 2023
- CVE-2025-6411337Monitor
Emby Server allows attackers to gain administrative server access without preconditions
CriticalCVSS 9.3No exploitEPSS 0%emby · embyDec 9, 2025
- CVE-2021-3283334Monitor
Unauthenticated file read in Emby Server
HighCVSS 8.6No exploitEPSS 1%emby · emby.releasesSep 8, 2021
- CVE-2025-6432533Monitor
Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard
HighCVSS 8.4No exploitEPSS 0%emby · embyNov 18, 2025
- CVE-2023-416724Monitor
Media Browser Emby Server cross site scripting
MediumCVSS 6.1No exploitEPSS 0%emby · emby.releasesAug 5, 2023
- CVE-2021-2582824Monitor
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.
MediumCVSS 6.1No exploitEPSS 0%emby · embyJun 28, 2023
- CVE-2022-3622324Monitor
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and
MediumCVSS 6.1No exploitEPSS 0%emby · embyDec 16, 2022
- CVE-2024-3093124Monitor
Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via
MediumCVSS 6.1No exploitEPSS 0%Jun 25, 2024