CVE-2026-25200

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover

This issue affects MagicINFO 9 Server: less than 21.1090.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Feb 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-252018.8An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue CVE-2026-252029.8The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue CVE-2026-252037.8Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: l CVE-2026-252047.5Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process a CVE-2026-252059.8Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash CVE-2026-252069.1Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc5 CVE-2026-252079.8Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b CVE-2026-252089.8Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4 CVE-2026-252099.1Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc5 CVE-2026-25219.8A weakness has been identified in Open5GS up to 2.7.6. This issue affects the function sgwc_s5c_handle_create_session_response of the compon CVE-2026-252107.8In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow ch CVE-2026-252113.2Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.