CVE-2020-37012

Tea LaTex 1.0 - Remote Code Execution

Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's tex2png API action.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ammarfaizi2

Products

Tea Latex

CVE-2009-10006

UFO: Alien Invasion <= 2.2.1 IRC Client Buffer Overflow

UFO: Alien Invasion versions up to and including 2.2.1 contain a buffer overflow vulnerability in its built-in IRC client component. When the client connects to an IRC server and receives a crafted numeric reply (specifically a 001 message), the application fails to properly validate the length of the response string. This results in a stack-based buffer overflow, which may corrupt control flow structures and allow arbitrary code execution. The vulnerability is triggered during automatic IRC connection handling and does not require user interaction beyond launching the game.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Alienform2 Project

Products

Alienform2

CVE-2009-20005

InterSystems Caché UtilConfigHome.csp Stack Buffer Overflow

A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Caché 2009.1. The vulnerability is triggered by sending a specially crafted HTTP GET request containing an oversized argument to the .csp handler. Due to insufficient bounds checking, the input overflows a stack buffer, allowing an attacker to overwrite control structures and execute arbitrary code. It is unknown if this vulnerability was patched and an affected version range remains undefined.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed

Vendors

Intersystems

Products

Cache

CVE-2009-20006

osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which is then executed by the server.

CVSS 4.0 · 9.3 Critical EPSS 2.3% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2009-20007

Talkative IRC v0.4.4.16 Response Buffer Overflow

Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings sent to a connected client. An attacker can exploit this flaw by sending an overly long message that overflows a fixed-length buffer, potentially leading to arbitrary code execution in the context of the vulnerable process. This vulnerability is exploitable remotely and does not require authentication.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed

Vendors

Talkative

Products

Irc

CVE-2009-20009

Belkin Bulldog Plus Web Service Buffer Overflow

Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before copying it into a fixed-size buffer, resulting in memory corruption and potential remote code execution. Exploitation requires network access and does not require prior authentication.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed

Vendors

Belkin

Products

Bulldog Plus

CVE-2009-20010

Dogfood CRM spell.php RCE

Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate escaping. This allows attackers to inject arbitrary shell commands and execute them on the server. The flaw is exploitable without authentication and was discovered by researcher LSO.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed

Vendors

—

Products

—

CVE-2009-20011

ContentKeeper Web Appliance < 125.10 RCE via mimencode

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.

CVSS 4.0 · 10 Critical EPSS 1.9% KEV · Not listed

Vendors

Contentkeeper Technologies

Products

Contentkeeper

CVE-2010-10013

AjaXplorer < 2.6 checkInstall.php Unauthenticated RCE

An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed

Vendors

Ajaxplorer

Products

Ajaxplorer

CVE-2010-10016

BS.Player 2.57 Buffer Overflow via M3U Playlist Import

BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.

CVSS 4.0 · 10 Critical EPSS 1.1% KEV · Not listed

Vendors

Bsplayer

Products

Bs.player

CVE-2010-20049

LeapFTP < 3.1.x Stack Buffer Overflow

LeapFTP < 3.1.x contains a stack-based buffer overflow vulnerability in its FTP client parser. When the client receives a directory listing containing a filename longer than 528 bytes, the application fails to properly bound-check the input and overwrites the Structured Exception Handler (SEH) chain. This allows an attacker operating a malicious FTP server to execute arbitrary code on the victim’s machine when the file is listed or downloaded.

CVSS 4.0 · 9.3 Critical EPSS 1.3% KEV · Not listed

Vendors

Leapware

Products

Leapftp

CVE-2010-20059

FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution

FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation.

CVSS 4.0 · 9.3 Critical EPSS 1.6% KEV · Not listed

Vendors

Ixsystems

Products

Freenas

CVE-2010-20112

Amlibweb NetOpacs webquery.dll Stack Buffer Overflow

Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed

Vendors

—

Products

—

CVE-2010-20115

Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption

Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.

CVSS 4.0 · 9.3 Critical EPSS 1.5% KEV · Not listed

Vendors

Arcane Software Microsoft

Products

Vermillion Ftp Daemon Windows

CVE-2010-20122

Xftp FTP Client <= 3.0 PWD Response Buffer Overflow

Xftp FTP Client version up to and including 3.0 (build 0238) contain a stack-based buffer overflow vulnerability triggered by a maliciously crafted PWD response from an FTP server. When the client connects to a server and receives an overly long directory string in response to the PWD command, the client fails to properly validate the length of the input before copying it into a fixed-size buffer. This results in memory corruption and allows remote attackers to execute arbitrary code on the client system.

CVSS 4.0 · 9.3 Critical EPSS 1.6% KEV · Not listed

Vendors

Netsarang

Products

Xftp

CVE-2011-10013

Traq 2.0–2.3 admincp/common.php RCE

Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php to inject and execute arbitrary PHP code.

CVSS 4.0 · 10 Critical EPSS 2.7% KEV · Not listed

Vendors

Traq

Products

Traq

CVE-2011-10032

Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57

Sunway ForceControl version 6.1 SP3 and earlier contains a stack-based buffer overflow vulnerability in the SNMP NetDBServer service, which listens on TCP port 2001. The flaw is triggered when the service receives a specially crafted packet using opcode 0x57 with an overly long payload. Due to improper bounds checking during packet parsing, attacker-controlled data overwrites the Structured Exception Handler (SEH), allowing arbitrary code execution in the context of the service. This vulnerability can be exploited remotely without authentication and may lead to full system compromise on affected Windows hosts.

CVSS 4.0 · 9.3 Critical EPSS 1.6% KEV · Not listed

Vendors

Microsoft Sunwayland

Products

Windows Forcecontrol

CVE-2011-10033

WordPress Plugin is-human <= v1.4.2 Eval Injection RCE

The WordPress plugin is-human <= v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval() on user-controlled input, which can lead to execution of attacker-supplied PHP and OS commands. This may result in arbitrary code execution as the webserver user, site compromise, or data exfiltration. The is-human plugin was made defunct in June 2008 and is no longer available for download. This vulnerability was exploited in the wild in March 2012.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Disable Wordpress Update Notifications And Auto-update Email Notifications Project Is-human Wordpress

Products

Is-human Plugin Is-human Wordpress Plugin Wordpress

CVE-2011-10041

Uploadify <= 1.0 Unauthenticated Arbitrary File Upload

Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2012-10025

WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include and execute arbitrary remote PHP code. This leads to remote code execution under the web server’s context, allowing full compromise of the host.

CVSS 4.0 · 10 Critical EPSS 2.1% KEV · Not listed

Vendors

Accesspressthemes Advanced Custom Fields Wordpress

Products

Frontend Post Wordpress Plugin Advanced Custom Fields Wordpress Plugin Wordpress