Emby

emby

Vendor: Emby • 6 CVEs

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-64113 1Emby 1Emby Jun 17, 2026 Dec 9, 2025 9.3 CRITICAL· v4 9.8 CRITICAL· v3 N/A· v2 Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than networ...Show more Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81.Show less
CVE-2025-64325 1Emby 1Emby Jun 17, 2026 Nov 18, 2025 8.4 HIGH· v4 9.0 CRITICAL· v3 N/A· v2 Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the...Show more Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta.Show less
CVE-2021-25828 1Emby 1Emby Jun 17, 2026 Jun 28, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.
CVE-2021-25827 1Emby 1Emby Jun 17, 2026 Jun 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
CVE-2022-36223 1Emby 1Emby Jun 17, 2026 Dec 16, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.
CVE-2020-26948 1Emby 1Emby Jun 17, 2026 Oct 10, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.