GCVE - cpe:2.3:a:emby:emby:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:emby:emby:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Emby (`3878c2b9-d2ac-5248-95bc-d449f164b231`)
Product	Emby (`9587e5ae-f755-530d-b26f-60737c983e71`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-64325`	vulnerable	2026-06-08 07:39:18.383579	Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta. Published: 2025-11-18T22:32:06.902Z Updated: 2025-11-19T16:44:25.026Z Open on db.gcve.eu Reference links https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-2gwc-988r-2r7x	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-64113`	vulnerable	2026-06-08 07:39:18.013269	Emby Server allows attackers to gain administrative server access without preconditions Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81. Published: 2025-12-09T19:21:12.232Z Updated: 2025-12-09T20:08:09.863Z Open on db.gcve.eu Reference links https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95fv-5gfj-2r84	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25828`	vulnerable	2026-06-08 05:30:41.589317	Details available Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web. Published: 2023-06-28T00:00:00.000Z Updated: 2024-12-05T16:51:27.114Z Open on db.gcve.eu Reference links https://github.com/MediaBrowser/Emby/issues/3785	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25827`	vulnerable	2026-06-08 05:30:41.588849	Details available Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address. Published: 2023-06-28T00:00:00.000Z Updated: 2025-02-13T16:27:50.814Z Open on db.gcve.eu Reference links https://emby.media/community/index.php?/topic/98191-emby-server-46-released/ https://github.com/MediaBrowser/Emby/issues/3784 https://github.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-26948`	vulnerable	2026-06-08 05:23:51.991017	Details available Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter. Published: 2020-10-10T20:12:31.000Z Updated: 2024-08-04T16:03:23.115Z Open on db.gcve.eu Reference links https://github.com/btnz-k/emby_ssrf https://github.com/btnz-k/emby_ssrf/blob/master/emby_scan.rb	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.