Plex

CVE-2025-69417 Jan 02, 17:16 MEDIUM POC This Month

In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint. [CVSS 5.0 MEDIUM]

CVE-2025-69416 Jan 02, 17:16 MEDIUM POC This Month

In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml. [CVSS 5.0 MEDIUM]

CVE-2025-69415 Jan 02, 17:16 HIGH POC This Week

In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account. [CVSS 7.1 HIGH]

CVE-2025-69414 Jan 02, 17:16 HIGH POC This Week

Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. [CVSS 8.5 HIGH]

CVE-2021-42835 Dec 08, 15:15 HIGH POC This Week

An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. Rated high severity (CVSS 7.0). Public exploit code available and no vendor patch available.

CVE-2020-5742 Jun 15, 20:15 HIGH POC This Week

Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-5741 May 08, 13:15 HIGH POC KEV THREAT Act Now

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-5740 Apr 22, 16:15 HIGH POC This Week

Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-19141 Dec 19, 23:15 HIGH This Week

The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2018-13415 Aug 13, 17:29 CRITICAL POC THREAT Act Now

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2014-9304 Dec 07, 21:59 HIGH POC This Week

Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted X-Plex-Url headers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2014-9181 Dec 02, 16:59 MEDIUM POC PATCH THREAT This Month

Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 15.3%.