This page lists publicly disclosed CVE vulnerabilities affecting m-files hubshare (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-9826 | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. | [email protected] | 7.0 | 0.24% | 2025-09-15 | 2026-06-17 |
| CVE-2024-9174 | Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI | [email protected] | 6.9 | 0.27% | 2024-10-02 | 2026-06-17 |
| CVE-2024-6881 | Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session | [email protected] | 8.5 | 0.35% | 2024-07-29 | 2026-06-17 |
| CVE-2024-6124 | Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session | [email protected] | 8.5 | 0.27% | 2024-07-29 | 2026-06-17 |
| CVE-2024-5142 | Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser | [email protected] | 7.0 | 0.31% | 2024-05-24 | 2026-06-17 |
| CVE-2022-39019 | Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server. | [email protected] | 6.3 | 0.37% | 2022-10-31 | 2026-06-17 |
| CVE-2022-39018 | Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. | [email protected] | 8.2 | 0.38% | 2022-10-31 | 2026-06-17 |
| CVE-2022-39017 | Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments. | [email protected] | 8.2 | 0.36% | 2022-10-31 | 2026-06-17 |
| CVE-2022-39016 | Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. | [email protected] | 8.2 | 0.49% | 2022-10-31 | 2026-06-17 |