Hubshare
CVEs (9)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-39018 | Hig | 0.53 | 8.2 | 0.00 | Oct 31, 2022 | Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL. | ||
| CVE-2022-39017 | Hig | 0.53 | 8.2 | 0.00 | Oct 31, 2022 | Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments. | ||
| CVE-2022-39016 | Hig | 0.53 | 8.2 | 0.00 | Oct 31, 2022 | Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. | ||
| CVE-2022-39019 | Med | 0.41 | 6.3 | 0.00 | Oct 31, 2022 | Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server. | ||
| CVE-2024-9174 | Med | 0.35 | 5.4 | 0.00 | Oct 2, 2024 | Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI | ||
| CVE-2024-6881 | Med | 0.35 | 5.4 | 0.00 | Jul 29, 2024 | Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session | ||
| CVE-2024-6124 | Med | 0.35 | 5.4 | 0.00 | Jul 29, 2024 | Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session | ||
| CVE-2024-5142 | Med | 0.35 | 5.4 | 0.00 | May 24, 2024 | Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser | ||
| CVE-2025-9826 | 0.00 | — | 0.00 | Sep 15, 2025 | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. |
- risk 0.53cvss 8.2epss 0.00
Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.
- risk 0.53cvss 8.2epss 0.00
Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments.
- risk 0.53cvss 8.2epss 0.00
Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.
- risk 0.41cvss 6.3epss 0.00
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.
- risk 0.35cvss 5.4epss 0.00
Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI
- risk 0.35cvss 5.4epss 0.00
Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session
- risk 0.35cvss 5.4epss 0.00
Reflected XSS in M-Files Hubshare before version 5.0.6.0 allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser session
- risk 0.35cvss 5.4epss 0.00
Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser
- CVE-2025-9826Sep 15, 2025risk 0.00cvss —epss 0.00
Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users.