CVE-2026-25200

Name of the Vulnerable Software and Affected Versions MagicINFO 9 Server versions prior to 21.1090.1

Description A flaw exists in MagicINFO 9 Server that permits authorized users to upload HTML files without requiring authentication. This can lead to Stored Cross-Site Scripting (XSS), potentially resulting in account takeover. The issue involves the unauthorized upload of HTML files, which can then be exploited to inject malicious scripts.

Recommendations Update MagicINFO 9 Server to version 21.1090.1 or later.