CVE-2012-10047

Cyclope Employee Surveillance Solution v6.x SQL Injection

Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.

CVSS 4.0 · 10 Critical EPSS 1.5% KEV · Not listed

Vendors

Qnap

Products

Surveillance Station

CVE-2012-10033

Narcissus backend.php Image Configuration Command Injection

Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.

CVSS 4.0 · 9.3 Critical EPSS 2.0% KEV · Not listed

Vendors

Angstrom Distribution Distribution

Products

Narcissus Distribution

CVE-2012-10055

ComSndFTP v1.3.7 Beta USER Format String RCE

ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.

CVSS 4.0 · 9.3 Critical EPSS 2.6% KEV · Not listed

Vendors

Cerberusftp Comsndftp

Products

Ftp Server Ftp Server

CVE-2012-10026

WordPress Plugin Asset-Manager <= 2.0 PHP File Upload

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Asset-manager Hp Wordpress

Products

Asset-manager Wordpress Plugin Asset Manager Wordpress

CVE-2012-10060

Sysax Multi Server < 5.55 SSH Username Buffer Overflow

Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service.

CVSS 4.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Sysax

Products

Multi Server

CVE-2012-10027

WordPress Plugin WP-Property <= 1.35.0 PHP File Upload

WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed

Vendors

Wordpress Wp-property Wp-property-hive

Products

Wordpress Wp-property Wordpress Plugin Wordpress Plugin

CVE-2013-10068

Foxit Reader <= 5.4.5.0114 Plugin URL Processing Buffer Overflow

Foxit Reader versions through 5.4.5.0114, including the bundled Foxit Reader Plugin 2.2.1.530, contains a stack-based buffer overflow vulnerability in the npFoxitReaderPlugin.dll module. When a PDF file is loaded from a remote host, an overly long query string in the URL can overflow a buffer, allowing remote attackers to execute arbitrary code.

CVSS 4.0 · 9.4 Critical EPSS 1.6% KEV · Not listed

Vendors

Foxit Foxit Software Foxitsoftware

Products

Reader Reader Foxit Reader

CVE-2009-10006

UFO: Alien Invasion <= 2.2.1 IRC Client Buffer Overflow

UFO: Alien Invasion versions up to and including 2.2.1 contain a buffer overflow vulnerability in its built-in IRC client component. When the client connects to an IRC server and receives a crafted numeric reply (specifically a 001 message), the application fails to properly validate the length of the response string. This results in a stack-based buffer overflow, which may corrupt control flow structures and allow arbitrary code execution. The vulnerability is triggered during automatic IRC connection handling and does not require user interaction beyond launching the game.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed

Vendors

Alienform2 Project

Products

Alienform2

CVE-2009-20005

InterSystems Caché UtilConfigHome.csp Stack Buffer Overflow

A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Caché 2009.1. The vulnerability is triggered by sending a specially crafted HTTP GET request containing an oversized argument to the .csp handler. Due to insufficient bounds checking, the input overflows a stack buffer, allowing an attacker to overwrite control structures and execute arbitrary code. It is unknown if this vulnerability was patched and an affected version range remains undefined.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed

Vendors

Intersystems

Products

Cache

CVE-2009-20006

osCommerce <= 2.2 Admin File Manager Arbitrary PHP Code Execution

osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface allows file uploads and edits without sufficient input validation or access control. An unauthenticated attacker can craft a POST request to upload a .php file containing arbitrary code, which is then executed by the server.

CVSS 4.0 · 9.3 Critical EPSS 2.3% KEV · Not listed

Vendors

Oscommerce

Products

Oscommerce

CVE-2009-20007

Talkative IRC v0.4.4.16 Response Buffer Overflow

Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings sent to a connected client. An attacker can exploit this flaw by sending an overly long message that overflows a fixed-length buffer, potentially leading to arbitrary code execution in the context of the vulnerable process. This vulnerability is exploitable remotely and does not require authentication.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed

Vendors

Talkative

Products

Irc

CVE-2009-20009

Belkin Bulldog Plus Web Service Buffer Overflow

Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before copying it into a fixed-size buffer, resulting in memory corruption and potential remote code execution. Exploitation requires network access and does not require prior authentication.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed

Vendors

Belkin

Products

Bulldog Plus

CVE-2009-20010

Dogfood CRM spell.php RCE

Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate escaping. This allows attackers to inject arbitrary shell commands and execute them on the server. The flaw is exploitable without authentication and was discovered by researcher LSO.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed

Vendors

—

Products

—

CVE-2009-20011

ContentKeeper Web Appliance < 125.10 RCE via mimencode

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.

CVSS 4.0 · 10 Critical EPSS 1.9% KEV · Not listed

Vendors

Contentkeeper Technologies

Products

Contentkeeper

CVE-2010-10013

AjaXplorer < 2.6 checkInstall.php Unauthenticated RCE

An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed

Vendors

Ajaxplorer

Products

Ajaxplorer

CVE-2010-10016

BS.Player 2.57 Buffer Overflow via M3U Playlist Import

BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.

CVSS 4.0 · 10 Critical EPSS 1.1% KEV · Not listed

Vendors

Bsplayer

Products

Bs.player

CVE-2010-20049

LeapFTP < 3.1.x Stack Buffer Overflow

LeapFTP < 3.1.x contains a stack-based buffer overflow vulnerability in its FTP client parser. When the client receives a directory listing containing a filename longer than 528 bytes, the application fails to properly bound-check the input and overwrites the Structured Exception Handler (SEH) chain. This allows an attacker operating a malicious FTP server to execute arbitrary code on the victim’s machine when the file is listed or downloaded.

CVSS 4.0 · 9.3 Critical EPSS 1.3% KEV · Not listed

Vendors

Leapware

Products

Leapftp

CVE-2010-20059

FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution

FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation.

CVSS 4.0 · 9.3 Critical EPSS 1.6% KEV · Not listed

Vendors

Ixsystems

Products

Freenas

CVE-2010-20112

Amlibweb NetOpacs webquery.dll Stack Buffer Overflow

Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed

Vendors

—

Products

—

CVE-2010-20115

Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption

Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.

CVSS 4.0 · 9.3 Critical EPSS 1.5% KEV · Not listed

Vendors

Arcane Software Microsoft

Products

Vermillion Ftp Daemon Windows