M-Files Hubshare
9 CVEs affecting M-Files Hubshare. Latest disclosed: 2025-09-15. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39018 | High | 8.2 | 2022-10-31 | Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. |
CVE-2022-39017 | High | 8.2 | 2022-10-31 | Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-… |
CVE-2022-39016 | High | 8.2 | 2022-10-31 | Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. |
CVE-2022-39019 | Medium | 6.3 | 2022-10-31 | Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the applicatio… |
CVE-2025-9826 | Medium | 5.4 | 2025-09-15 | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. |
CVE-2024-9174 | Medium | 5.4 | 2024-10-02 | Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI |
CVE-2024-6881 | Medium | 5.4 | 2024-07-29 | Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session |
CVE-2024-6124 | Medium | 5.4 | 2024-07-29 | Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session |
CVE-2024-5142 | Medium | 5.4 | 2024-05-24 | Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other use… |