CVE-2020-5741

Plex Media Server on Windows prior to version 1.19.3 is affected by CVE-2020-5741: an authenticated attacker can trigger unsafe Python pickle deserialization (Dict file) during camera-upload related processing, leading to remote code execution as the OS user who runs Plex. Public references descr...

CVE-2020-5742

CVE-2020-5742 : Affected software is Plex Media Server. The vulnerability is due to improper access control, allowing any origin to execute cross-origin application requests prior to 2020-06-15. The root cause is inadequate restriction on cross-origin interactions, enabling potentially unauthoriz...

CVE-2020-5740

Plex Media Server (Windows) is affected by CVE-2020-5740 due to improper input validation. The vulnerability allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges through the Plex update service/related input handling. This is a local privilege-escalatio...

CVE-2021-42835

Plex Media Server up to version 1.24.4.5081-e362dc1ee is affected by a TOCTOU race in the exposed RPC interface of the Product Update Service, enabling a local attacker with a low-privileged account to interact with the RPC and execute code from a chosen path (local or via SMB) with the update se...

CVE-2026-96656

Plex Media Server versions before 1.43.3.10861 are vulnerable to an arbitrary file write flaw. The issue arises because the TranscoderH264Options preference is appended verbatim to the x264 option string during every transcode. An admin user can exploit this to write arbitrary files that may be e...

CVE-2026-96651

Plex Media Server before version 1.43.3.10861 is vulnerable to a path traversal flaw because the software fails to validate ../ sequences in the url parameter. An attacker can exploit this via the /system/agents/media/get endpoint to read any file accessible by the target user. Specifically, an a...

CVE-2026-96652

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to Server-Side Request Forgery (SSRF) via the /player/timeline endpoint. An attacker who possesses any valid X-Plex-Token can manipulate the protocol parameter to include a full URL, forcing the server to perform a POST request to a ...

CVE-2026-96655

Plex Media Server versions before 1.43.3.10861 are vulnerable to a Server-Side Request Forgery (SSRF) . An authenticated user can exploit the '/video/:/transcode/universal' path parameter to force the server to make requests to arbitrary internal or external addresses . The provided documents do ...

CVE-2026-96654

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a URL injection flaw. The software fails to correctly neutralize URL values within the 'searchOne' parameter, which enables an attacker to call functions from other plugins and provide their own parameters. While the documents do ...