# Samsung MagicINFO Server has three flaws, including stored XSS through HTML uploads

- Date: 2026-02-02
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2026-25200, CVE-2026-25201, CVE-2026-25202
- Products: [MagicINFO](https://signagelist.org/products/magicinfo/)

NVD published 3 vulnerabilities in Samsung MagicINFO Server, covering cross-site scripting, privilege escalation and hard-coded credentials. A flaw in MagicINFO 9 Server lets authorized users upload HTML files without authentication, leading to stored XSS that can result in account takeover. This issue affects MagicINFO 9 Server: less than 21.1090.1.

## Sources

- [CVE-2026-25200](https://nvd.nist.gov/vuln/detail/CVE-2026-25200) (NIST NVD)
- [CVE-2026-25201](https://nvd.nist.gov/vuln/detail/CVE-2026-25201) (NIST NVD)
- [CVE-2026-25202](https://nvd.nist.gov/vuln/detail/CVE-2026-25202) (NIST NVD)
- [https://security.samsungtv.com/securityUpdates](https://security.samsungtv.com/securityUpdates)

Page: https://signagelist.org/incidents/2026-02-samsung-magicinfo-server-has-three-flaws-including/