CVE-2021-37253

Affected software: M-Files Web before 20.10.9524.1. Vulnerability: DoS due to improper handling of overlapping Range/Request-Range headers in HTTP requests, as described by multiple sources. Root cause/condition: crafted Range headers trigger high CPU/memory consumption, leading to denial of acce...

CVE-2025-3087

CVE-2025-3087 concerns a stored XSS in M-Files Web. Affected are M-Files Web versions 25.1.14445.5 through 25.2.14524.4. The issue arises from stored cross-site scripting that can be triggered by an authenticated user who can run scripts. Documented impact is that scripts may be executed in the u...

CVE-2021-41807

The CVE-2021-41807 issue affects M-Files Server and M-Files Web prior to version 21.12.10873.0. Root cause: lack of rate limiting on certain user accounts enables unlimited login attempts, facilitating brute-forcing of accounts. Impact is a high-severity authentication weakness with potential for...

CVE-2021-37254

CVE-2021-37254 affects M-Files Web prior to 20.10.9524.1 and 20.10.9445.0. A remote attacker could obtain unauthenticated access to license key information for third‑party components stored on the server. Root cause and exact exploitation details are not provided in the documents. No remediation ...