CVE-2026-96654

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a URL injection flaw. The software fails to correctly neutralize URL values within the 'searchOne' parameter, which enables an attacker to call functions from other plugins and provide their own parameters. While the documents do ...