Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 467

Export CSV
CVE-2021-47787

TotalAV 5.15.69 - Unquoted Service Path

TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers can place malicious executables in specific unquoted path segments to potentially gain SYSTEM-level access by exploiting the service path configuration.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Totalav
Products
Totalav
CVE-2025-41359

Multiple vulnerabilities in Small HTTP server by Smallsrv

Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Smallsrv
Products
Small Http Small Http Server
CVE-2026-33253

Unquoted Service Path Allows SYSTEM Privilege Escalation in SANYO DENKI SANUPS Software

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Sanyo Denki
Products
Sanups Software Sanups Software Standalone
CVE-2023-54331

Outline 1.6.0 - Unquoted Service Path

Outline 1.6.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path in the OutlineService executable to inject malicious code that will be executed with LocalSystem permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Getoutline
Products
Outline
CVE-2022-50923

Cobian Backup 0.9 - Unquoted Service Path

Cobian Backup 0.9 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the CobianReflectorService to inject malicious code that will execute with LocalSystem permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Cobiansoft
Products
Cobian Backup
CVE-2022-50903

Wondershare MobileTrans 3.5.9 - 'ElevationService' Unquoted Service Path

Wondershare MobileTrans 3.5.9 contains an unquoted service path vulnerability in the ElevationService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path by placing malicious executables in specific filesystem locations that will be executed with LocalSystem permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wondershare
Products
Mobiletrans
CVE-2022-50901

Wondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path

Wondershare Dr.Fone 11.4.9 contains an unquoted service path vulnerability in the DFWSIDService that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\ to inject malicious executables that would run with LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wondershare
Products
Dr.fone
CVE-2022-50900

Wondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service Path

Wondershare Dr.Fone 12.0.18 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit the misconfigured service path to insert malicious code that will be executed with LocalSystem permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wondershare
Products
Dr.fone
CVE-2021-47810

WibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service Path

WibuKey Runtime 6.51 contains an unquoted service path vulnerability in the WkSvW32.exe service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\PROGRAM FILES (X86)\WIBUKEY\SERVER\WkSvW32.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wibu
Products
Wibukey
CVE-2021-47809

Disk Sorter Enterprise 13.6.12 - 'Disk Sorter Enterprise' Unquoted Service Path

Disk Sorter Enterprise 13.6.12 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Sorter Enterprise\bin\disksrs.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Disksorter Flexense
Products
Disk Sorter Disk Sorter
CVE-2021-47805

Disk Savvy 13.6.14 - 'Multiple' Unquoted Service Path

Disk Savvy 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries to inject malicious executables that will be run with elevated LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Disksavvy Flexense
Products
Disk Savvy Disksavvy Enterprise Disksavvy
CVE-2021-47780

Macro Expert 4.7 - Unquoted Service Path

Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the improperly configured service path to inject malicious executables that will be run with LocalSystem permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Macro-expert Macroexpert
Products
Macro Expert Macroexpert
CVE-2020-36930

SysGauge 7.9.18 - ' SysGauge Server' Unquoted Service Path

SysGauge Server 7.9.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\SysGauge Server\bin\sysgaus.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Sysgauge
CVE-2020-36927

DiskPulse 13.6.14 - Unquoted Service Path

DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Pulse Enterprise\bin\diskpls.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense
Products
Diskpulse
CVE-2019-25308

Mikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Service Path

Mikogo 5.2.2.150317 contains an unquoted service path vulnerability in the Mikogo-Service Windows service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with LocalSystem privileges by placing executable files in specific path locations.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Litemanager Team Mikogo
Products
Mikogo Mikogo
CVE-2019-25267

Wing FTP Server 6.0.7 - Unquoted Service Path

Wing FTP Server 6.0.7 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wftpserver
Products
Wing Ftp Server
CVE-2019-25261

AnyDesk 5.4.0 - Unquoted Service Path

AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially inject malicious executables. Attackers can exploit the unquoted binary path to place malicious files in service executable locations, potentially gaining elevated system privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Anydesk
Products
Anydesk
CVE-2025-57714

NetBak Replicator

An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: NetBak Replicator 4.5.15.0807 and later

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Qnap
Products
Netbak Replicator
CVE-2025-36384

IBM Db2 Privilege Escalation

IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path element.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2
CVE-2020-37100

Sync Breeze Enterprise 12.4.18 - Unquoted Service Path

Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations to hijack the service startup process.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Flexense Syncbreeze
Products
Syncbreeze Sync Breeze