CVE-2021-25828

MEDIUM

MEDIUM Priority: 0.03 BB Relevance: 62/100

Published: 2023-06-28 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Network Low Complexity No Auth Scope Change

AV: Network

AC: Low

PR: None

UI: Required

S: Changed

C: Low

I: Low

A: None

Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web.

CWE-79

Vendor	Product	Version
emby	emby	< 4.6.0.50

https://github.com/MediaBrowser/Emby/issues/3785

Exploit Issue Tracking Patch

62 / 100

✓ Network accessible
✓ No authentication
✓ Low complexity

6.1 / 10.0 v3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.53%

Raw Score 0.005300

Percentile 44.7%

Date 2026-10-29

nvd ref →