Stored XSS in MagicINFO 9 Server Enables Account Takeover

Publication date: 2026-02-02

Last updated on: 2026-03-10

Assigner: Samsung TV & Appliance

Description

A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue affects MagicINFO 9 Server: less than 21.1090.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-03-10

Generated

2026-07-06

AI Q&A

2026-02-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-25200

EUVD

EUVD-2026-5090

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	magicinfo_9_server	to 21.1090.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without proper authentication, which leads to Stored Cross-Site Scripting (XSS). This means malicious scripts can be stored on the server and executed in users' browsers, potentially compromising accounts.

Impact Analysis

The vulnerability can lead to account takeover by attackers exploiting the Stored XSS flaw. This can result in unauthorized access to user accounts, data theft, and potentially full control over affected systems.

Hi! I’m here to help you understand CVE-2026-25200. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70