Freeloader

plexmediaservercrack 的 Docker 支持 对运行在 Docker 中的 Plex Media Server 进行补丁——包括官方 plexinc/pms-docker 镜像 和社区 lscr.io/linuxserver/plex 镜像——使用与原生 systemd 安装相同的 LDPRELOAD-on-the-PMS-exec 机制。 有关原因和故障排除，请参阅顶层 README 和完整指南 docs/DOCKER.md。 构建 从项目根目录执行： root@kitploit: 官方镜像 plexinc/pms-docker docker build -f...

CVE-2021-33959

CVE-2021-33959 可以看到，Plex 服务监听了 32410、32412、32413 和 32414 四个 udp 端口。通过分析攻击载荷，并参考设备查询请求的消息格式，我们编写软件向这些端口发送带有 M-SEARCH HTTP/1.1 攻击载荷的 udp 数据包，并抓包获取反射源 IP。最后，我们发现 32410 和 32414 都会响应。复现攻击如下图所示： 发送请求 echo "M-SEARCH HTTP/1.1" | nc -4u 32410 示例 受影响版本 plex media server - 1.21 之前 参考链接...

PlEXcalaison

本地权限提升 - CVE-2021-42835 Windows 版 Plex Media Server 1.25.0.5282 之前版本存在检查时间与使用时间漏洞（TOCTOU），允许低权限用户获取 SYSTEM 权限。 发现者 Tomer Peled、Netanel Cohen 以及 BugSec 安全研究员 Amir Shen。 详情 Windows 版 Plex 使用 PlexUpdateService.exe 来安装新更新。该服务在 SYSTEM 上下文中运行。安装更新时，服务首先验证文件完整性和数字签名，只有检查通过后才安装更新。...

EUVD-2026-34286

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public /image/ route that resolves attacker-controlled entries from imagehashlookup and replays them through the same server-side image fetch logic used by authenticated image proxying...

EUVD-2026-34273

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely...

EUVD-2026-17208

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version 2.17.0...

CVE-2026-31804

CVE-2026-31804 affects Tautulli (Python-based Plex monitor) before version 2.17.0. The vulnerable /pms_image_proxy endpoint accepts a user-controlled img parameter and forwards it to Plex Media Server’s /photo/:/ transcode transcoder without authentication or host/scheme restrictions. Because web...

CVE-2026-31804 Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pmsimageproxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme...

CVE-2021-33959

Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service...

Plex Media Server <= 1.43.0.10389 Multiple Vulnerabilities

Plex Media Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:plex:plexmediaserver";...

CVE-2025-69417

In the plex.tv backend for Plex Media Server PMS through 2025-12-31, a non-server device token can retrieve share tokens intended for unrelated access via a sharedservers endpoint...

CVE-2025-69415

In Plex Media Server PMS through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account...

CVE-2025-69414

Plex Media Server PMS through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token...

CVE-2025-69416

In the plex.tv backend for Plex Media Server PMS through 2025-12-31, a non-server device token can retrieve other tokens intended for unrelated access via clients.plex.tv/devices.xml...

CVE-2025-69417

In the plex.tv backend for Plex Media Server PMS through 2025-12-31, a non-server device token can retrieve share tokens intended for unrelated access via a sharedservers endpoint...

CVE-2025-69416

In the plex.tv backend for Plex Media Server PMS through 2025-12-31, a non-server device token can retrieve other tokens intended for unrelated access via clients.plex.tv/devices.xml...

CVE-2025-69417

In the plex.tv backend for Plex Media Server PMS through 2025-12-31, a non-server device token can retrieve share tokens intended for unrelated access via a sharedservers endpoint...

CVE-2025-69416

In the plex.tv backend for Plex Media Server PMS through 2025-12-31, a non-server device token can retrieve other tokens intended for unrelated access via clients.plex.tv/devices.xml...

CVE-2025-69415

In Plex Media Server PMS through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account...

CVE-2025-69414

Plex Media Server PMS through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token...