CVE-2021-41810: medium-severity vulnerability in M-Files Server
Script injection in M-Files Admin
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.2epss 0.7%
Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Affected products
M-Files Corporation · M-Files ServerRelated CVEs — M-Files Server
In the same product, most dangerous first.
CVE-2025-5964HIGHPath traversal in M-Files APIEPSS 13.0%CVE-2023-6912HIGHBrute force vulnerability in M-Files user authenticationEPSS 1.0%CVE-2023-6910MEDIUMUncontrolled Resource Consumption in M-Files ServerEPSS 0.9%CVE-2024-4056HIGHDenial of service condition in M-Files ServerEPSS 0.8%CVE-2024-0563MEDIUMDenial of service condition in M-Files ServerEPSS 0.7%CVE-2024-10127CRITICALSupport for authentication bypass condition in M-Files LDAP authenticationEPSS 0.6%