Plex Media_server
14 CVEs affecting Plex Media_server. Latest disclosed: 2026-01-02. Critical: 1, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-13415 | Critical | 9.8 | 2018-08-13 | In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, u… |
CVE-2020-5742 | High | 8.8 | 2020-06-15 | Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. |
CVE-2019-19141 | High | 8.8 | 2019-12-19 | The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the… |
CVE-2025-69414 | High | 8.5 | 2026-01-02 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. |
CVE-2020-5740 | High | 7.8 | 2020-04-22 | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. |
CVE-2021-33959 | High | 7.5 | 2023-01-18 | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. |
CVE-2020-5741 | High | 7.2 | 2020-05-08 | Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. |
CVE-2025-69415 | High | 7.1 | 2026-01-02 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is curre… |
CVE-2021-42835 | High | 7.0 | 2021-12-08 | An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can a… |
CVE-2018-21031 | Medium | 6.5 | 2019-11-18 | Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and ca… |
CVE-2025-69417 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via… |
CVE-2025-69416 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via… |
CVE-2014-9304 | | 2014-12-07 | Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions… | |
CVE-2014-9181 | | 2014-12-02 | Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI t… |