← Vulnerability feed

Vulnerability record · CVE-2026-25200 · published 2 February 2026

CVE-2026-25200: Samsung magicinfo 9 server unrestricted file upload vulnerability

Samsung · Magicinfo 9 Server

A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue affects MagicINFO 9 Server: less than 21.1090.1.

9.8 CVSS 3.1 Critical EPSS 0.51% · top 58.6% CWE-434 · Unrestricted file upload
9.8CVSS 3.1 base score
0.51%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue affects MagicINFO 9 Server: less than 21.1090.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security.samsungtv.com/securityUpdates Vendor Advisory

Track CVE-2026-25200 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-4632Samsung MagicINFO 9 Server path traversal allows arbitrary file writeSamsung MagicINFO 9 Server before version 21.1052 contains a path traversal flaw (CWE-22) that lets an attacker write arbitrary files with system aut…KEVEPSS 24%analysed9.8CVE-2024-7399Samsung MagicINFO 9 Server path traversal allows arbitrary file writeSamsung MagicINFO 9 Server before version 21.1050 contains a path traversal flaw (CWE-22) that also enables unrestricted file upload (CWE-434), letti…KEVEPSS 92%analysed9.8CVE-2026-25202Samsung magicinfo 9 server hard-coded credentials vulnerabilityThe database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects M…EPSS 0.46%9.8CVE-2025-54455Samsung magicinfo 9 server hard-coded credentials vulnerabilityUse of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Ser…EPSS 0.55%9.8CVE-2025-54448Samsung magicinfo 9 server unrestricted file upload vulnerabilityUnrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects Magi…EPSS 0.60%9.8CVE-2025-54449Samsung magicinfo 9 server unrestricted file upload vulnerabilityUnrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects Magi…EPSS 0.63%9.8CVE-2025-54450Samsung magicinfo 9 server path traversal vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code In…EPSS 0.59%9.8CVE-2025-54451Samsung magicinfo 9 server code injection vulnerabilityImproper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue af…EPSS 0.65%

Source: NIST National Vulnerability Database (record CVE-2026-25200), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.