CVE-2021-33959

CVE-2021-33959 可以看到，Plex 服务监听了 32410、32412、32413 和 32414 四个 udp 端口。通过分析攻击载荷，并参考设备查询请求的消息格式，我们编写软件向这些端口发送带有 M-SEARCH HTTP/1.1 攻击载荷的 udp 数据包，并抓包获取反射源 IP。最后，我们发现 32410 和 32414 都会响应。复现攻击如下图所示： 发送请求 echo "M-SEARCH HTTP/1.1" | nc -4u 32410 示例 受影响版本 plex media server - 1.21 之前 参考链接...

Freeloader

plexmediaservercrack 的 Docker 支持 对运行在 Docker 中的 Plex Media Server 进行补丁——包括官方 plexinc/pms-docker 镜像 和社区 lscr.io/linuxserver/plex 镜像——使用与原生 systemd 安装相同的 LDPRELOAD-on-the-PMS-exec 机制。 有关原因和故障排除，请参阅顶层 README 和完整指南 docs/DOCKER.md。 构建 从项目根目录执行： 官方镜像 plexinc/pms-docker docker build -f...

PlEXcalaison

本地权限提升 - CVE-2021-42835 Windows 版 Plex Media Server 1.25.0.5282 之前版本存在检查时间与使用时间漏洞（TOCTOU），允许低权限用户获取 SYSTEM 权限。 发现者 Tomer Peled、Netanel Cohen 以及 BugSec 安全研究员 Amir Shen。 详情 Windows 版 Plex 使用 PlexUpdateService.exe 来安装新更新。该服务在 SYSTEM 上下文中运行。安装更新时，服务首先验证文件完整性和数字签名，只有检查通过后才安装更新。...

CVE-2026-96651

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the...

CVE-2026-96654

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

CVE-2026-96655

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96656

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-96652

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96656 Plex Media Server arbitrary file write

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

EUVD-2026-85370

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-96656

Plex Media Server versions before 1.43.3.10861 are vulnerable to an arbitrary file write flaw. The issue arises because the TranscoderH264Options preference is appended verbatim to the x264 option string during every transcode. An admin user can exploit this to write arbitrary files that may be e...

CVE-2026-96656 Plex Media Server arbitrary file write

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

EUVD-2026-85369

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655

Plex Media Server versions before 1.43.3.10861 are vulnerable to a Server-Side Request Forgery (SSRF) . An authenticated user can exploit the '/video/:/transcode/universal' path parameter to force the server to make requests to arbitrary internal or external addresses . The provided documents do ...

CVE-2026-96654 Plex Media Server URL injection

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

EUVD-2026-85368

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

CVE-2026-96654 Plex Media Server URL injection

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

CVE-2026-96654

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a URL injection flaw. The software fails to correctly neutralize URL values within the 'searchOne' parameter, which enables an attacker to call functions from other plugins and provide their own parameters. While the documents do ...