Media Server
Vendor:
First CVE: Dec 2, 2014 · Active for 11 years
15
Total CVEs
More Total CVEs than 92% of tracked products
1.9
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
7.2
Avg CVSS
Higher Avg CVSS than 43% of tracked products
6.7%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Media Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 2, 2014
11 years ago
Most Recent CVE
Jan 2, 2026
203 days ago
CVE Severity & Scoring
Media Server15 CVEs
27%
67%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local2 (13.3%)
Network11 (73.3%)
Unknown2 (13.3%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (80.0%)
High1 (6.7%)
Unknown2 (13.3%)
User Interaction
None12 (80.0%)
Unknown2 (13.3%)
Required1 (6.7%)
Privileges Required
Low9 (60.0%)
High1 (6.7%)
None3 (20.0%)
Unknown2 (13.3%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-5741HIGH Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. | May 8, 2020 | 7.2 | 94 | YES | YES |
CVE-2018-13415CRITICAL In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. Remote, unauthenticated attack | Aug 13, 2018 | 9.8 | 61 | NO | YES |
CVE-2025-34158HIGH Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the s | Aug 21, 2025 | 8.5 | 32 | NO | NO |
CVE-2021-33959HIGH Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. | Jan 18, 2023 | 7.5 | 31 | NO | NO |
CVE-2014-9304HIGH Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafted | Dec 7, 2014 | 7.5 | 31 | NO | YES |
CVE-2020-5742HIGH Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests. | Jun 15, 2020 | 8.8 | 28 | NO | NO |
CVE-2019-19141HIGH The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server ha | Dec 19, 2019 | 8.8 | 27 | NO | NO |
CVE-2014-9181MEDIUM Multiple directory traversal vulnerabilities in Plex Media Server before 0.9.9.3 allow remote attackers to read arbitrary files via a .. (dot dot) in the URI to (1) manage/ or (2) | Dec 2, 2014 | 5.0 | 26 | NO | YES |
CVE-2025-69414HIGH Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. | Jan 2, 2026 | 7.1 | 25 | NO | NO |
CVE-2025-69415HIGH In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with | Jan 2, 2026 | 7.1 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
1 CVE
6.7% of CVEs· 97th percentile
Metasploit
1 CVE
6.7% of CVEs· 97th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
3 CVEs
20.0% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For Media Server
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.18.2.2029-36236cc4c | 1 | 6.5 | 2.1% | 0 | 0 |
| 1.13.2.5154 | 1 | 9.8 | 31.8% | 0 | 1 |