CVE-2026-25200
Unknown Unknown - Not Provided
Stored XSS in MagicINFO 9 Server Enables Account Takeover

Publication date: 2026-02-02

Last updated on: 2026-03-10

Assigner: Samsung TV & Appliance

Description
A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue affects MagicINFO 9 Server: less than 21.1090.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-02
Last Modified
2026-03-10
Generated
2026-06-16
AI Q&A
2026-02-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25200
EUVD
EUVD-2026-5090
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
samsung magicinfo_9_server to 21.1090.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without proper authentication, which leads to Stored Cross-Site Scripting (XSS). This means malicious scripts can be stored on the server and executed in users' browsers, potentially compromising accounts.

Impact Analysis

The vulnerability can lead to account takeover by attackers exploiting the Stored XSS flaw. This can result in unauthorized access to user accounts, data theft, and potentially full control over affected systems.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart