CVE-2025-46320

A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution

Medium · published February 24, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Published
2026-02-24T20:30Z
EPSS history
Timeline
  • 24 FEB 20:30Z
    A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution
    cvelistv5