Media Server
Monthly
Authenticated code execution in Plex Media Server before 1.43.3.10861 is a genuine but privilege-gated code-execution flaw: an attacker who first obtains admin-level access to the server's management interface can leverage the TranscoderH264Options preference, which is appended verbatim to x264's option string on every transcode, or write a malicious .so file that is loaded and executed at startup without signature, execute-bit, or symbol checks. This affects servers running versions prior to 1.43.3.10861; no public exploit was identified at time of analysis, and the supplied CVSS 4.0 score is 8.6 with PR:H, consistent with our independent CVSS 3.1 assessment requiring high privileges (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because Plex admin is often the single server-owner account, the realistic attack path is credential compromise or exposure of the admin interface to untrusted networks; execution then occurs on the next transcode or after a server restart.
Path traversal in Plex Media Server before 1.43.3.10861 lets an attacker who can reach the /system/agents/media/get endpoint read files accessible to the targeted Plex user by supplying ../ sequences in the url parameter. The primary exploitation path requires a valid Plex session token (the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. authenticated), while a secondary, lower-barrier path lets a LAN-adjacent attacker supply a crafted X-Forwarded-For header that the server trusts as evidence of local context. Read access is nominally bounded by the victim account's permissions, but because the reachable files include the PlexOnlineToken store, successful exploitation escalates from file disclosure to full Plex account and server takeover; no CISA KEV entry or public exploit code appears in the supplied intelligence, and a vendor fix is available in version 1.43.3.10861.
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-side request forgery in Plex Media Server before 1.43.3.10861 allows any authenticated user - including a low-trust account invited only to a shared library - to coerce the server into issuing HTTP requests to arbitrary internal or external addresses through the path parameter of the '/video/:/transcode/universal' endpoint. The attacker gains no code execution and the assessed impact is confidentiality-only and limited (CVSS 4.3, C:L/I:N/A:N), but the flaw is a useful internal-network reconnaissance and pivot primitive on internet-facing or flat-network deployments. No public exploit identified at time of analysis; exploitation requires a valid authenticated session and a server running a version prior to 1.43.3.10861.
Improper neutralization of URL values in Plex Media Server's 'searchOne' parameter allows a remote attacker to invoke other plugins' functions and supply their own arguments, affecting all releases before 1.43.3.10861. The flaw is scored 6.9 (medium) under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), and an independent assessment agrees on a network-reachable, low-complexity request-forgery/parameter-injection class issue with only LOW confidentiality and integrity impact and no availability impact: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. No public exploit code was identified at time of analysis (a third-party writeup is referenced in the source list, but that is not confirmation of weaponization), and the vector's PR:N claim should be validated in practice because Plex APIs commonly require a server token and real-world exposure depends on whether the server or its API is reachable beyond localhost.
Server-side request forgery in Plex Media Server before 1.43.3.10861 allows a low-privileged, token-bearing caller to force the server to POST to an arbitrary destination by putting a full URL in the 'protocol' parameter of the '/player/timeline' endpoint. Because any X-Plex-Token value is accepted, the authentication barrier is effectively trivial, but the assessed impact is limited to a blind outbound request (confidentiality-low, no integrity or availability effect) against hosts reachable by the Plex process. No CISA KEV entry and no confirmed exploitation have been reported, and no public exploit code was identified at time of analysis; the practical risk is a genuine but low-priority SSRF that matters most for internet- or DMZ-exposed servers that can reach sensitive internal services.
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint. [CVSS 5.0 MEDIUM]
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml. [CVSS 5.0 MEDIUM]
In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account. [CVSS 7.1 HIGH]
Plex Media Server builds through 1.42.2.10156 can return a permanent account access token to a caller who already holds a valid transient Plex token via the /myplex/account endpoint, turning short-lived access into durable account access. This is a CWE-863 authorization bypass with a network attack vector and low complexity, but it requires the prerequisite transient token, so it is not an unauthenticated from-zero compromise. Publicly available exploit code exists, EPSS is very low at 0.04% (13th percentile), and no confirmed active exploitation is reported in the provided data.
The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.
A security vulnerability in application uses a weak password (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.
Cleartext credential transmission vulnerability where a server accepts authentication methods that transmit credentials over unencrypted channels, allowing network-based attackers to intercept and expose user credentials without requiring authentication or user interaction. The vulnerability affects any server implementation supporting plaintext credential transmission over HTTP or other unencrypted protocols. This is a high-severity confidentiality issue (CVSS 7.5) with network-accessible attack vector and no complexity requirements, making it exploitable by unauthenticated remote attackers through passive network interception.
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of their computer while clicking on seemingly innocuous objects.
CVE-2025-49189 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
CVE-2025-49183 is an unencrypted HTTP communication vulnerability in a REST API that exposes all traffic to network-level interception, allowing unauthenticated attackers to gather sensitive information and exfiltrate media files without authentication or user interaction required. The vulnerability affects systems using unencrypted REST API endpoints and carries a CVSS 7.5 score reflecting high confidentiality impact; real-world exploitation risk depends on network positioning and whether the affected API handles sensitive data or privileged operations.
Critical credential exposure vulnerability where admin login credentials and property configuration passwords are embedded directly in source code, enabling unauthenticated remote attackers to gain full administrative access to the affected application. The vulnerability has a CVSS score of 7.5 (High) with a network attack vector requiring no privileges or user interaction. While specific KEV/EPSS data and POC availability are not provided in the input, the presence of hardcoded credentials in source code represents a severe and often easily discoverable weakness that typically sees rapid exploitation once disclosed.
CVE-2025-49181 is an authorization bypass vulnerability in an unspecified API endpoint that allows unauthenticated remote attackers to read sensitive information via HTTP GET requests and modify service configuration (log paths, TCP ports) via HTTP POST requests, potentially causing denial of service. With a CVSS score of 8.6 and network-accessible attack vector requiring no authentication, this vulnerability presents a significant risk to exposed instances; KEV/EPSS/POC status cannot be confirmed from provided data, warranting immediate investigation of affected infrastructure.
Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_uac_stop_timer function at /uac/sip-uac-transaction.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_subscribe_remove function at /uac/sip-uac-subscribe.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. Rated high severity (CVSS 7.0). Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 39.8%.
Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.3%.
Authenticated code execution in Plex Media Server before 1.43.3.10861 is a genuine but privilege-gated code-execution flaw: an attacker who first obtains admin-level access to the server's management interface can leverage the TranscoderH264Options preference, which is appended verbatim to x264's option string on every transcode, or write a malicious .so file that is loaded and executed at startup without signature, execute-bit, or symbol checks. This affects servers running versions prior to 1.43.3.10861; no public exploit was identified at time of analysis, and the supplied CVSS 4.0 score is 8.6 with PR:H, consistent with our independent CVSS 3.1 assessment requiring high privileges (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because Plex admin is often the single server-owner account, the realistic attack path is credential compromise or exposure of the admin interface to untrusted networks; execution then occurs on the next transcode or after a server restart.
Path traversal in Plex Media Server before 1.43.3.10861 lets an attacker who can reach the /system/agents/media/get endpoint read files accessible to the targeted Plex user by supplying ../ sequences in the url parameter. The primary exploitation path requires a valid Plex session token (the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. authenticated), while a secondary, lower-barrier path lets a LAN-adjacent attacker supply a crafted X-Forwarded-For header that the server trusts as evidence of local context. Read access is nominally bounded by the victim account's permissions, but because the reachable files include the PlexOnlineToken store, successful exploitation escalates from file disclosure to full Plex account and server takeover; no CISA KEV entry or public exploit code appears in the supplied intelligence, and a vendor fix is available in version 1.43.3.10861.
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-side request forgery in Plex Media Server before 1.43.3.10861 allows any authenticated user - including a low-trust account invited only to a shared library - to coerce the server into issuing HTTP requests to arbitrary internal or external addresses through the path parameter of the '/video/:/transcode/universal' endpoint. The attacker gains no code execution and the assessed impact is confidentiality-only and limited (CVSS 4.3, C:L/I:N/A:N), but the flaw is a useful internal-network reconnaissance and pivot primitive on internet-facing or flat-network deployments. No public exploit identified at time of analysis; exploitation requires a valid authenticated session and a server running a version prior to 1.43.3.10861.
Improper neutralization of URL values in Plex Media Server's 'searchOne' parameter allows a remote attacker to invoke other plugins' functions and supply their own arguments, affecting all releases before 1.43.3.10861. The flaw is scored 6.9 (medium) under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), and an independent assessment agrees on a network-reachable, low-complexity request-forgery/parameter-injection class issue with only LOW confidentiality and integrity impact and no availability impact: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. No public exploit code was identified at time of analysis (a third-party writeup is referenced in the source list, but that is not confirmation of weaponization), and the vector's PR:N claim should be validated in practice because Plex APIs commonly require a server token and real-world exposure depends on whether the server or its API is reachable beyond localhost.
Server-side request forgery in Plex Media Server before 1.43.3.10861 allows a low-privileged, token-bearing caller to force the server to POST to an arbitrary destination by putting a full URL in the 'protocol' parameter of the '/player/timeline' endpoint. Because any X-Plex-Token value is accepted, the authentication barrier is effectively trivial, but the assessed impact is limited to a blind outbound request (confidentiality-low, no integrity or availability effect) against hosts reachable by the Plex process. No CISA KEV entry and no confirmed exploitation have been reported, and no public exploit code was identified at time of analysis; the practical risk is a genuine but low-priority SSRF that matters most for internet- or DMZ-exposed servers that can reach sensitive internal services.
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint. [CVSS 5.0 MEDIUM]
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml. [CVSS 5.0 MEDIUM]
In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account. [CVSS 7.1 HIGH]
Plex Media Server builds through 1.42.2.10156 can return a permanent account access token to a caller who already holds a valid transient Plex token via the /myplex/account endpoint, turning short-lived access into durable account access. This is a CWE-863 authorization bypass with a network attack vector and low complexity, but it requires the prerequisite transient token, so it is not an unauthenticated from-zero compromise. Publicly available exploit code exists, EPSS is very low at 0.04% (13th percentile), and no confirmed active exploitation is reported in the provided data.
The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.
A security vulnerability in application uses a weak password (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.
Cleartext credential transmission vulnerability where a server accepts authentication methods that transmit credentials over unencrypted channels, allowing network-based attackers to intercept and expose user credentials without requiring authentication or user interaction. The vulnerability affects any server implementation supporting plaintext credential transmission over HTTP or other unencrypted protocols. This is a high-severity confidentiality issue (CVSS 7.5) with network-accessible attack vector and no complexity requirements, making it exploitable by unauthenticated remote attackers through passive network interception.
The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).
The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of their computer while clicking on seemingly innocuous objects.
CVE-2025-49189 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
CVE-2025-49183 is an unencrypted HTTP communication vulnerability in a REST API that exposes all traffic to network-level interception, allowing unauthenticated attackers to gather sensitive information and exfiltrate media files without authentication or user interaction required. The vulnerability affects systems using unencrypted REST API endpoints and carries a CVSS 7.5 score reflecting high confidentiality impact; real-world exploitation risk depends on network positioning and whether the affected API handles sensitive data or privileged operations.
Critical credential exposure vulnerability where admin login credentials and property configuration passwords are embedded directly in source code, enabling unauthenticated remote attackers to gain full administrative access to the affected application. The vulnerability has a CVSS score of 7.5 (High) with a network attack vector requiring no privileges or user interaction. While specific KEV/EPSS data and POC availability are not provided in the input, the presence of hardcoded credentials in source code represents a severe and often easily discoverable weakness that typically sees rapid exploitation once disclosed.
CVE-2025-49181 is an authorization bypass vulnerability in an unspecified API endpoint that allows unauthenticated remote attackers to read sensitive information via HTTP GET requests and modify service configuration (log paths, TCP ports) via HTTP POST requests, potentially causing denial of service. With a CVSS score of 8.6 and network-accessible attack vector requiring no authentication, this vulnerability presents a significant risk to exposed instances; KEV/EPSS/POC status cannot be confirmed from provided data, warranting immediate investigation of affected infrastructure.
Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_uac_stop_timer function at /uac/sip-uac-transaction.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip_subscribe_remove function at /uac/sip-uac-subscribe.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remote attackers to obtain sensitive information via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary code via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. Rated high severity (CVSS 7.0). Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 39.8%.
Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.3%.