Feb 2, 2026 Global

Samsung MagicINFO Server has three flaws, including stored XSS through HTML uploads

NVD published 3 vulnerabilities in Samsung MagicINFO Server, covering cross-site scripting, privilege escalation and hard-coded credentials. A flaw in MagicINFO 9 Server lets authorized users upload HTML files without authentication, leading to stored XSS that can result in account takeover. This issue affects MagicINFO 9 Server: less than 21.1090.1.

Type: Vulnerability
Sector: Vendor
Country: Global
CVE: CVE-2026-25200 CVE-2026-25201 CVE-2026-25202

Products in the directory

MagicINFO

Sources

CVE-2026-25200 · NIST NVD
CVE-2026-25201 · NIST NVD
CVE-2026-25202 · NIST NVD
https://security.samsungtv.com/securityUpdates