CVE-2025-49193

Missing HTTP Security Headers

4.2 Medium

The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.31%Up 0.3 points since Jun 13, 2025

What each source reports

CVE List Score used 4.2

Missing HTTP Security Headers

Record: CVE-2025-49193
CVSS 3.1: 4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-693
Updated: 2026-11-02

EUVDEUVD-2025-18192 4.2

Record: EUVD-2025-18192
CVSS 3.1: 4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p883-qggf-j55h 4.2

The application fails to implement several security headers. These headers help increase the...

Record: GHSA-p883-qggf-j55h
CVSS 3.1: 4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-693
Updated: 2026-11-02

NVD 4.2

Record: CVE-2025-49193
CVSS 3.1: 4.2 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-693
Updated: 2026-11-02

Affected products

Show 1 moreShow less

sick ag tire analytics

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-49193 is a medium vulnerability (CVSS 4.2) in Plex Media Server, published June 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. No source names a fixed version.