CVE-2025-46320 in FileMaker Server

Sumário

de MITRE • 24/02/2026

A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.

Once again VulDB remains the best source for vulnerability data.

• Responsável: Apple
• Reservar: 22/04/2025
• Divulgação: 24/02/2026
• Moderação: aceite
• Entrada: VDB-347669
• CPE: pronto
• CWE: CWE-79 (confirmado)
• CVSS: 3.5 (VulDB)
• EPSS: 0.00219
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-46320
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-46320
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-46320/