CVE-2021-25828
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web. The vulnerability may allow an attacker to inject malicious script.
Risk Assessment
This could lead to session theft, account takeover, or other browser-based attacks. Organizations using Emby Server are at risk.
Recommendation
Update Emby Server to version 4.6.0.50 or later.
Other vulnerabilities in Emby Server
See all- CVE-2025-64325Critical
Emby Server prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta allows a malicious user to send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization.
- CVE-2021-25827Critical
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP address.
- CVE-2023-33193Critical
A vulnerability in Emby Server may allow administrative access to the system, depending on user account settings. An attacker could spoof headers, enabling passwordless login or viewing a list of user accounts that may not have a password configured.
Original NVD description (English source)
Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS