M-Files records

58 published records for vendor m-files.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 13.8%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

58 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2021-41807No exploit	Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.m-files · m-files server · CWE-307 Pre-auth	Critical9.8	—	1.1%	Jan 18, 2022
39Monitor	CVE-2023-6912No exploit	Brute force vulnerability in M-Files user authenticationm-files · m-files server · CWE-307 Pre-auth	Critical9.8	—	0.9%	Dec 20, 2023
37Monitor	CVE-2025-5964Proof of concept	Path traversal in M-Files APIm-files · m-files server · CWE-22 Path traversal	High8.4	—	13.0%	Jun 15, 2025
36Monitor	CVE-2024-10127No exploit	Support for authentication bypass condition in M-Files LDAP authenticationm-files · m-files server · CWE-303 Pre-auth Auth bypass	Critical9.2	—	0.6%	Nov 20, 2024
35Monitor	CVE-2022-39016No exploit	Javascript injection in PDFtron in M-Files Hubsharem-files · hubshare · CWE-20	High8.8	—	0.6%	Oct 31, 2022
35Monitor	CVE-2023-6239No exploit	Incorrect calculation of effective permissionsm-files · m-files server · CWE-281	High8.8	—	0.5%	Nov 28, 2023
34Monitor	CVE-2024-6881No exploit	Stored XSS Vulnerabilitym-files · hubshare · CWE-79 RCE XSS	High8.5	—	0.3%	Jul 29, 2024
34Monitor	CVE-2024-6124No exploit	Reflected XSS in Hubshare via Open Redirectm-files · hubshare · CWE-79 pre-auth RCE XSS Open redirect	High8.5	—	0.3%	Jul 29, 2024
33Monitor	CVE-2024-6789No exploit	Path traversal in M-Files APIm-files · m-files server · CWE-22 Path traversal	High8.4	—	0.5%	Aug 27, 2024
31Monitor	CVE-2021-37253No exploit	M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headm-files · m-files web · CWE-444 Pre-auth Denial of service	High7.5	—	2.9%	Dec 5, 2021
31Monitor	CVE-2023-5523No exploit	M-Files Web Companion allows Remote Code Executionm-files · web companion · CWE-829 RCE	High7.8	—	0.3%	Oct 20, 2023
31Monitor	CVE-2023-0213No exploit	Local Elevation of Privilege in M-Filesm-files · m-files · CWE-427 Local privilege escalation	High7.8	—	0.2%	Mar 29, 2023
31Monitor	CVE-2023-2480No exploit	Elevation of Privilege in M-Files Desktop Clientm-files · m-files · CWE-280 Local privilege escalation	High7.8	—	0.1%	May 25, 2023
31Monitor	CVE-2023-2112No exploit	Desktop component allows lateral movement between sessionsm-files · m-files server · CWE-284 Broken access control (IDOR)	High7.8	—	0.1%	Apr 20, 2023
30Monitor	CVE-2021-37254No exploit	In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated accem-files · m-files web Pre-auth Auth bypass	High7.5	—	1.3%	Oct 28, 2021
30Monitor	CVE-2023-3405No exploit	Denial of service condition in M-Files Serverm-files · m-files server · CWE-248 Pre-auth Denial of service	High7.5	—	0.8%	Jun 27, 2023
30Monitor	CVE-2023-0383No exploit	Uncontrolled Resource Consuption in M-Files Serverm-files · m-files server · CWE-770 Pre-auth Denial of service	High7.5	—	0.8%	Apr 20, 2023
30Monitor	CVE-2023-0384No exploit	Uncontrolled Resource Consuption in M-Files Serverm-files · m-files server · CWE-400 Pre-auth Denial of service	High7.5	—	0.7%	Apr 20, 2023
30Monitor	CVE-2024-4056No exploit	Denial of service condition in M-Files Serverm-files · m-files server · CWE-1333 Pre-auth Denial of service	High7.5	—	0.7%	Apr 26, 2024
30Monitor	CVE-2023-6117No exploit	M-Files REST API allows Denial of Servicem-files · m-files server · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Nov 22, 2023
30Monitor	CVE-2022-3284No exploit	Insecure way of passing a download keym-files · m-files server · CWE-200 Pre-auth Info leak	High7.5	—	0.6%	Mar 6, 2023
30Monitor	CVE-2022-39018No exploit	Broken access controls on PDFtron data in M-Files Hubsharem-files · hubshare · CWE-200 Pre-auth Broken access control (IDOR) Info leak	High7.5	—	0.5%	Oct 31, 2022
30Monitor	CVE-2022-4858No exploit	Insertion of Sensitive Information into Log Filem-files · m-files server · CWE-532 Pre-auth Info leak	High7.5	—	0.4%	Dec 30, 2022
30Monitor	CVE-2022-39019No exploit	Broken access controls on PDFtron WebviewerUI in M-Files Hubsharem-files · hubshare · CWE-287 Pre-auth Auth bypass Broken access control (IDOR)	High7.5	—	0.4%	Oct 31, 2022
30Monitor	CVE-2022-4862No exploit	XSS vulnerability in M-Files Webm-files · m-files server · CWE-200 XSS Info leak	High7.6	—	0.3%	Mar 6, 2023

CVE-2021-41807
39Monitor
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
m-files · m-files serverJan 18, 2022
CVE-2023-6912
39Monitor
Brute force vulnerability in M-Files user authentication
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
m-files · m-files serverDec 20, 2023
CVE-2025-5964
37Monitor
Path traversal in M-Files API
HighCVSS 8.4Proof of conceptEPSS 13%
- Path traversal
m-files · m-files serverJun 15, 2025
CVE-2024-10127
36Monitor
Support for authentication bypass condition in M-Files LDAP authentication
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
m-files · m-files serverNov 20, 2024
CVE-2022-39016
35Monitor
Javascript injection in PDFtron in M-Files Hubshare
HighCVSS 8.8No exploitEPSS 0%
m-files · hubshareOct 31, 2022
CVE-2023-6239
35Monitor
Incorrect calculation of effective permissions
HighCVSS 8.8No exploitEPSS 0%
m-files · m-files serverNov 28, 2023
CVE-2024-6881
34Monitor
Stored XSS Vulnerability
HighCVSS 8.5No exploitEPSS 0%
- RCE
- XSS
m-files · hubshareJul 29, 2024
CVE-2024-6124
34Monitor
Reflected XSS in Hubshare via Open Redirect
HighCVSS 8.5No exploitEPSS 0%
- pre-auth RCE
- XSS
- Open redirect
m-files · hubshareJul 29, 2024
CVE-2024-6789
33Monitor
Path traversal in M-Files API
HighCVSS 8.4No exploitEPSS 0%
- Path traversal
m-files · m-files serverAug 27, 2024
CVE-2021-37253
31Monitor
M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range head
HighCVSS 7.5No exploitEPSS 2%
- Pre-auth
- Denial of service
m-files · m-files webDec 5, 2021
CVE-2023-5523
31Monitor
M-Files Web Companion allows Remote Code Execution
HighCVSS 7.8No exploitEPSS 0%
- RCE
m-files · web companionOct 20, 2023
CVE-2023-0213
31Monitor
Local Elevation of Privilege in M-Files
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
m-files · m-filesMar 29, 2023
CVE-2023-2480
31Monitor
Elevation of Privilege in M-Files Desktop Client
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
m-files · m-filesMay 25, 2023
CVE-2023-2112
31Monitor
Desktop component allows lateral movement between sessions
HighCVSS 7.8No exploitEPSS 0%
- Broken access control (IDOR)
m-files · m-files serverApr 20, 2023
CVE-2021-37254
30Monitor
In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated acce
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Auth bypass
m-files · m-files webOct 28, 2021
CVE-2023-3405
30Monitor
Denial of service condition in M-Files Server
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
m-files · m-files serverJun 27, 2023
CVE-2023-0383
30Monitor
Uncontrolled Resource Consuption in M-Files Server
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
m-files · m-files serverApr 20, 2023
CVE-2023-0384
30Monitor
Uncontrolled Resource Consuption in M-Files Server
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
m-files · m-files serverApr 20, 2023
CVE-2024-4056
30Monitor
Denial of service condition in M-Files Server
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
m-files · m-files serverApr 26, 2024
CVE-2023-6117
30Monitor
M-Files REST API allows Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
m-files · m-files serverNov 22, 2023
CVE-2022-3284
30Monitor
Insecure way of passing a download key
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
m-files · m-files serverMar 6, 2023
CVE-2022-39018
30Monitor
Broken access controls on PDFtron data in M-Files Hubshare
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Info leak
m-files · hubshareOct 31, 2022
CVE-2022-4858
30Monitor
Insertion of Sensitive Information into Log File
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
m-files · m-files serverDec 30, 2022
CVE-2022-39019
30Monitor
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
m-files · hubshareOct 31, 2022
CVE-2022-4862
30Monitor
XSS vulnerability in M-Files Web
HighCVSS 7.6No exploitEPSS 0%
- XSS
- Info leak
m-files · m-files serverMar 6, 2023