CVE-2023-6912

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Dec 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-69138.1A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an CVE-2023-69155.5A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this libra CVE-2023-69167.2Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation.CVE-2023-69176.7A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd CVE-2023-69185.3A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backen CVE-2023-69197.5Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. VGuard allows Absolute Path Traversal. This is CVE-2023-69219.1Blind SQL Injection vulnerability in PrestaShow Google Integrator (PrestaShop addon) allows for data extraction and modification. This attac CVE-2023-69226.5The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to CVE-2023-69236.1The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite CVE-2023-69244.8The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1 CVE-2023-69257.2The Unlimited Addons for WPBakery Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type va CVE-2023-69267.8There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access