Filemaker Server
Vendor:
First CVE: Nov 22, 2021 · Active for 4 years
10
Total CVEs
More Total CVEs than 88% of tracked products
2.5
Avg CVEs / Year
Higher CVE frequency than 74% of tracked products
6.0
Avg CVSS
Higher Avg CVSS than 21% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Filemaker Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 22, 2021
4 years ago
Most Recent CVE
Jul 9, 2026
15 days ago
CVE Severity & Scoring
Filemaker Server10 CVEs
80%
10%
10%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (10.0%)
Network9 (90.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low10 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None7 (70.0%)
Unknown0 (0.0%)
Required3 (30.0%)
Privileges Required
Low1 (10.0%)
High3 (30.0%)
None6 (60.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-46295CRITICAL Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because s | Dec 16, 2025 | 9.8 | 35 | NO | NO |
CVE-2026-43752MEDIUM An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the Adm | Jul 9, 2026 | 4.9 | 25 | NO | NO |
CVE-2025-46320MEDIUM A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully a | Feb 24, 2026 | 6.1 | 22 | NO | NO |
CVE-2024-27790HIGH Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue has been fixed in FileM | May 14, 2024 | 7.5 | 22 | NO | NO |
CVE-2025-46296MEDIUM An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing licens | Dec 16, 2025 | 5.4 | 21 | NO | NO |
CVE-2025-46294MEDIUM To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCreation in the Windows r | Dec 16, 2025 | 5.3 | 20 | NO | NO |
CVE-2021-44147MEDIUM An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose local files via a crafted XML/Excel documen | Nov 22, 2021 | 5.5 | 20 | NO | NO |
CVE-2024-27794MEDIUM Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect lo | Apr 15, 2024 | 6.1 | 18 | NO | NO |
CVE-2023-42954MEDIUM A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator | Mar 21, 2024 | 4.9 | 16 | NO | NO |
CVE-2023-42955MEDIUM Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrator | May 14, 2024 | 4.9 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (10 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (10 CVEs).
Media Mentions
Signals from CVEs in this product scope (10 CVEs).
Top CNAs Publishing CVEs For Filemaker Server
Top CWEs
Versions
No cataloged versions.