PT-2025-14853 · M Files · M-Files Server Admin Tool

Name of the Vulnerable Software and Affected Versions: M-Files Server Admin tool versions prior to 25.3.14681.7 Description: The issue concerns a stored XSS in the desktop UI of the M-Files Server Admin tool. This allows authenticated local users to execute scripts through the UI. Recommendations...

M-Files Web 安全漏洞

M-Files Web is an intelligent information management platform from M-Files USA, Inc. It is used to optimally support users in their daily work. A security vulnerability exists in M-Files Web versions 25.1.14445.5 through 25.2.14524.4 that stems from a stored cross-site scripting attack...

M-Files Server 安全漏洞

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in M-Files Server versions prior to 25.3.14681.7, which stems from stored cross-site scripting and could lead to script execution by a local user...

The vulnerability of the M-Files Server platform, which is related to the use of files and directories accessible to external parties, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the M-Files Server platform for document automation involves the use of files and directories accessible to external parties. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2025-0648

Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change...

CVE-2025-0648

Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change...

CVE-2025-0648

Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change...

CVE-2025-0648

Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change...

CVE-2025-0619

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords...

CVE-2025-0619

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords...

CVE-2025-0635

Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions...

CVE-2025-0619

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords...

CVE-2025-0635

Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions...

CVE-2025-0635

Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions...

CVE-2025-0635 Denial of Service condition in M-Files Server

Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions...

CVE-2025-0635 Denial of Service condition in M-Files Server

Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions...

CVE-2025-0635

CVE-2025-0635 affects M-Files Server, where an unauthenticated client can cause a denial of service in versions prior to 25.1.14445.5. The issue is triggered under certain conditions and impacts availability; exploitation details are not provided in the documents. Remediation: upgrade to 25.1.144...

CVE-2025-0619 Unsafe stored password recovery

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords...

CVE-2025-0619 Unsafe stored password recovery

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords...

CVE-2025-0619

The CVE-2025-0619 entry concerns M-Files Server prior to version 25.1, where unsafe password recovery from configuration allows a highly privileged user to recover external connector passwords. The issue’s root cause is improper handling of password recovery settings in configuration, enabling ac...