CVE-2021-26626CWE-20

tobesoft XPLATFORM Arbitrary file execution Vulnerability

High · published April 19, 2022

CVSS v3.1
8.1
EPSS
1%
Percentile
69.2
In the wild
Unconfirmed
What it is

Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The passed parameter is an arbitrary code to be executed. Remote attackers can use this vulnerability to execute arbitrary remote code.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01250 · 69.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2022-04-19T20:26Z
EPSS history
Timeline
  • 19 APR 20:26Z
    tobesoft XPLATFORM Arbitrary file execution Vulnerability
    cvelistv5