---METADATA---
VENDOR: Allok Soft
PRODUCT: Allok Video Converter
AFFECTED_VERSIONS: 4.6.1217
---END_METADATA---

Description Summary:
Allok Video Converter 4.6.1217 contains a stack overflow vulnerability in the License Name field, allowing attackers to execute arbitrary code via SEH handler overwrites.

Executive Summary:
A stack-based buffer overflow in Allok Video Converter allows an attacker to execute arbitrary system commands by providing a specially crafted payload in the License Name input field.

Vulnerability Details

CVE-ID: CVE-2020-37184

Affected Software: Allok Soft Allok Video Converter

Affected Versions: 4.6.1217

Vulnerability: This is a stack overflow vulnerability located in the License Name input field. By injecting malicious bytecode, an attacker can overwrite Structured Exception Handler (SEH) records to gain control of the execution flow and execute arbitrary code.

Business Impact

Successful exploitation allows for full system compromise on the machine running the software. Given the CVSS score of 9.8, the risk is critical; an attacker could gain a foothold in the corporate network, install persistent malware, or steal sensitive user data.

Remediation Plan

Immediate Action: Discontinue the use of Allok Video Converter version 4.6.1217 and update to the latest available version provided by the vendor.

Proactive Monitoring: Monitor endpoint detection and response (EDR) systems for unusual process spawning from the Allok Video Converter executable.

Compensating Controls: Implement application whitelisting and restrict administrative privileges for end-users to limit the impact of a successful software-based exploit.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late-disclosure vulnerability from 2020, published in 2026. While no active exploitation is currently reported, the technical details provided make the creation of a functional exploit highly feasible for skilled actors.

Analyst Recommendation

Because this vulnerability allows for remote code execution via a simple input field, it is classified as critical. Organizations should immediately identify and update or remove this software from all workstations to mitigate the risk of local privilege escalation or remote compromise.

---METADATA---
VENDOR: Allok
PRODUCT: RM RMVB to AVI MPEG DVD Converter
AFFECTED_VERSIONS: 3.6.1217
---END_METADATA---

Description Summary:
Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 contains a stack overflow in the License Name input field, allowing attackers to overwrite SEH registers and execute arbitrary code.

Executive Summary:
Allok Converter software is vulnerable to a stack-based buffer overflow that allows attackers to execute arbitrary system commands via a malicious license input.

Vulnerability Details

CVE-ID: CVE-2020-37183

Affected Software: Allok RM RMVB to AVI MPEG DVD Converter

Affected Versions: 3.6.1217

Vulnerability: A stack overflow vulnerability exists in the License Name input field of the application. By entering a specially crafted, overly long string, an attacker can overwrite the Structured Exception Handler (SEH) registers to execute arbitrary code.

Business Impact

This flaw allows an attacker to execute system commands, such as launching applications or downloading malware, under the context of the current user. The CVSS score of 9.8 indicates a critical risk to the integrity and confidentiality of the host system, particularly if the software is used in a business environment.

Remediation Plan

Immediate Action: Update the Allok Converter to the latest available version or replace it with a secure alternative.

Proactive Monitoring: Use host-based intrusion prevention systems (HIPS) to detect and block buffer overflow attempts against desktop applications.

Compensating Controls: Restrict the ability of standard users to install or run unapproved third-party software that may contain legacy vulnerabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This 2020 vulnerability was disclosed late. There is no evidence of widespread active exploitation, but the flaw remains a viable vector for local privilege escalation or initial execution.

Analyst Recommendation

Immediate action is required to either patch or remove this software. Legacy converters are frequent sources of buffer overflow vulnerabilities, and maintaining them poses an unnecessary risk to the organizational security posture.

---METADATA---
VENDOR: Torrent
PRODUCT: FLV Converter
AFFECTED_VERSIONS: 1.51 Build 117
---END_METADATA---

Description Summary:
Torrent FLV Converter 1.51 Build 117 contains a stack overflow vulnerability in the registration code input, allowing attackers to execute arbitrary code via SEH overwrite on Windows 32-bit systems.

Executive Summary:
Torrent FLV Converter is vulnerable to a stack-based buffer overflow that could allow an attacker to execute malicious code on the host system.

Vulnerability Details

CVE-ID: CVE-2020-37181

Affected Software: Torrent FLV Converter

Affected Versions: 1.51 Build 117

Vulnerability: A stack overflow vulnerability exists when processing registration codes. By providing a specially crafted input, an attacker can trigger a buffer overflow to overwrite the Structured Exception Handler (SEH), leading to arbitrary code execution on 32-bit Windows systems.

Business Impact

Exploitation allows for local code execution with the privileges of the user running the application. This could lead to data theft, malware installation, or system instability. The CVSS score of 9.8 reflects the high potential for impact, though exploitation typically requires the user to input a malicious string.

Remediation Plan

Immediate Action: Discontinue the use of the vulnerable version and update to a patched release or migrate to a supported alternative converter.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for suspicious process spawns (e.g., cmd.exe or powershell.exe) from the converter application.

Compensating Controls: Enable Windows security features such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) to make exploitation more difficult.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late disclosure of a 2020 vulnerability. As of Feb 11, 2026, there is no evidence of active exploitation, but the technical details for SEH overwrites are well-documented.

Analyst Recommendation

Users should avoid using legacy software that does not receive regular security updates. The primary recommendation is to update the software immediately or replace it with a modern, secure equivalent to mitigate the risk of code execution.

---METADATA---
VENDOR: Torrent
PRODUCT: 3GP Converter
AFFECTED_VERSIONS: 1.51
---END_METADATA---

Description Summary:
Torrent 3GP Converter 1.51 is vulnerable to a stack overflow via the registration dialog, allowing attackers to overwrite SEH registers and execute arbitrary code on the host system.

Executive Summary:
Torrent 3GP Converter contains a critical stack overflow vulnerability that permits arbitrary code execution through a malicious registration payload.

Vulnerability Details

CVE-ID: CVE-2020-37176

Affected Software: Torrent 3GP Converter

Affected Versions: 1.51

Vulnerability: The application is susceptible to a stack-based buffer overflow within its registration dialog. An attacker can craft a malicious payload that overwrites the Structured Exception Handler (SEH) registers, leading to the execution of arbitrary code when the overflow is triggered.

Business Impact

A successful exploit grants the attacker the ability to execute code with the same privileges as the application user. This could result in the installation of malware or unauthorized access to local files. The CVSS score of 9.8 reflects the critical potential for system-wide impact if the application is run with elevated privileges.

Remediation Plan

Immediate Action: Update to the latest version of Torrent 3GP Converter or uninstall the software if it is no longer required for business operations.

Proactive Monitoring: Monitor for suspicious child processes being created by the converter application, which may indicate successful shellcode execution.

Compensating Controls: Implement application whitelisting and ensure that users do not run media conversion software with administrative privileges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late disclosure from 2020. While no active exploitation is currently reported, the vulnerability is a classic buffer overflow that is well-understood by threat actors.

Analyst Recommendation

The risk of arbitrary code execution necessitates immediate remediation. Organizations should prioritize updating the software or transitioning to a more modern, actively supported media conversion utility to ensure continued security.

---METADATA---
VENDOR: Ecommerce Systempay
PRODUCT: Systempay
AFFECTED_VERSIONS: 1.0
---END_METADATA---

Description Summary:
Ecommerce Systempay 1.0 uses a weak cryptographic implementation, allowing attackers to brute-force the production secret key and forge payment signatures.

Executive Summary:
A critical cryptographic weakness in Ecommerce Systempay 1.0 allows attackers to forge payment signatures and manipulate transaction data.

Vulnerability Details

CVE-ID: CVE-2020-37168

Affected Software: Ecommerce Systempay 1.0

Affected Versions: 1.0

Vulnerability: The software employs an insecure cryptographic implementation for its 16-character production secret key. An attacker can perform a brute-force attack on the key using captured POST requests, subsequently allowing for the forging of valid payment signatures.

Business Impact

With a CVSS score of 9.8, this flaw presents a direct financial risk. Attackers can manipulate transaction amounts and payment data, leading to significant financial losses, fraud, and potential regulatory penalties for non-compliance with payment processing standards (e.g., PCI-DSS).

Remediation Plan

Immediate Action: Upgrade to the latest version of the Ecommerce Systempay software and rotate all secret keys immediately.

Proactive Monitoring: Monitor payment transaction logs for inconsistencies, such as unexpected transaction amounts or signatures that do not match expected patterns.

Compensating Controls: Implement strict rate limiting on the payment endpoint to prevent brute-force attempts on the secret key.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Financial integrity is paramount; the ability to forge payment signatures effectively negates the security of the entire payment workflow. Organizations must prioritize upgrading this component and treat all transaction data processed through this version as potentially compromised.

---METADATA---
VENDOR: Cisco
PRODUCT: ClamAV
AFFECTED_VERSIONS: ClamAV ClamBC
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The ClamAV ClamBC bytecode interpreter contains a vulnerability in function name processing that allows attackers to manipulate bytecode and potentially execute malicious code.

Executive Summary:
A critical code injection vulnerability in the ClamAV ClamBC bytecode interpreter allows unauthenticated attackers to execute malicious code via manipulated function names.

Vulnerability Details

CVE-ID: CVE-2020-37167

Affected Software: Cisco ClamAV (ClamBC)

Affected Versions: All versions prior to 0.103.0-rc

Vulnerability: The vulnerability exists in the ClamBC bytecode interpreter due to improper input validation during function name processing. This allows an attacker to inject and execute malicious bytecode within the engine.

Business Impact

Exploitation of this vulnerability allows for arbitrary code execution, which can lead to full system compromise if the ClamAV process is running with elevated privileges. Given the CVSS score of 9.8, this poses a severe threat to any infrastructure relying on ClamAV for malware scanning and perimeter security.

Remediation Plan

Immediate Action: Upgrade all instances of ClamAV to version 0.103.0-rc or later to ensure the bytecode interpreter is properly secured.

Proactive Monitoring: Review system logs for signs of anomalous ClamAV process behavior or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Isolate scanning engines within restricted environments (sandboxing) to limit the potential impact of a successful remote code execution attack.

Exploitation Status

Public Exploit Available: Yes — an exploit entry exists on ExploitDB.

Analyst Notes: As of Feb 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of weaponized exploit code significantly increases the risk of successful targeting.

Analyst Recommendation

Organizations must prioritize updating their ClamAV installations immediately. The combination of a critical CVSS score and existing public exploit code necessitates an urgent response to prevent potential system-wide compromise.

---METADATA---
VENDOR: Wedding Slideshow Studio
PRODUCT: Wedding Slideshow Studio
AFFECTED_VERSIONS: 1.36
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Wedding Slideshow Studio 1.36 allows attackers to execute arbitrary code by supplying a malicious 1608-byte registration key.

Executive Summary:
Wedding Slideshow Studio 1.36 is susceptible to a critical buffer overflow that allows attackers to execute arbitrary code by supplying a 1608-byte payload in the registration key field.

Vulnerability Details

CVE-ID: CVE-2020-37162

Affected Software: Wedding Slideshow Studio Wedding Slideshow Studio

Affected Versions: 1.36

Vulnerability: A stack-based buffer overflow exists in the registration key input mechanism of the application. By providing a malicious payload of exactly 1608 bytes, an attacker can overwrite the stack and redirect execution flow to arbitrary commands.

Business Impact

The vulnerability facilitates complete system compromise through remote code execution. The CVSS score of 9.8 underscores the high risk, as an attacker could potentially use this flaw to install malware, steal sensitive user data, or disrupt business operations.

Remediation Plan

Immediate Action: Immediately update Wedding Slideshow Studio to the latest version or apply any available vendor patches specifically targeting the registration module.

Proactive Monitoring: Monitor for crashed application instances which may indicate failed or successful exploitation attempts involving stack exhaustion.

Compensating Controls: Deploy host-based intrusion prevention systems (HIPS) to detect and block stack-based overflow attempts in real-time.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 7, 2026, there is no public information indicating active exploitation of this vulnerability. This vulnerability is distinct from CVE-2020-37161 as it targets the registration key field rather than the name field.

Analyst Recommendation

The presence of multiple critical buffer overflows in the same version of this software indicates a significant lack of secure coding practices. Immediate updating is mandatory to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: Wedding Slideshow Studio
PRODUCT: Wedding Slideshow Studio
AFFECTED_VERSIONS: 1.36
---END_METADATA---

Description Summary:
Wedding Slideshow Studio 1.36 contains a buffer overflow in the registration name field, allowing attackers to execute arbitrary system commands via a malicious payload.

Executive Summary:
A critical buffer overflow vulnerability in Wedding Slideshow Studio 1.36 allows attackers to execute arbitrary system commands by providing a malicious registration name.

Vulnerability Details

CVE-ID: CVE-2020-37161

Affected Software: Wedding Slideshow Studio Wedding Slideshow Studio

Affected Versions: 1.36

Vulnerability: This vulnerability is a classic buffer overflow located in the "registration name" input field. An attacker can craft a specially designed payload that, when entered into the registration field, triggers memory corruption and allows for the execution of arbitrary commands, such as launching system utilities.

Business Impact

Successful exploitation grants the attacker the ability to run code with the privileges of the logged-in user. With a CVSS score of 9.8, this flaw could be used as an entry point for further exploitation of the host system and the local network.

Remediation Plan

Immediate Action: Update Wedding Slideshow Studio to the latest version to address the improper handling of registration input.

Proactive Monitoring: Review application logs for unusually long strings entered into registration or configuration fields.

Compensating Controls: Implement application whitelisting to prevent the execution of unauthorized binaries or scripts spawned by the slideshow software.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 7, 2026, there is no public information indicating active exploitation of this vulnerability. The vulnerability demonstrates a fundamental failure in input validation within the registration module.

Analyst Recommendation

Due to the critical severity and the potential for remote code execution, it is recommended that this software be updated or removed immediately. Organizations should ensure that all third-party media software is included in regular vulnerability scanning cycles.

---METADATA---
VENDOR: Parallaxis
PRODUCT: Cuckoo Clock
AFFECTED_VERSIONS: 5.0
---END_METADATA---

Description Summary:
Parallaxis Cuckoo Clock 5.0 is vulnerable to a buffer overflow in alarm scheduling, enabling shellcode execution via EIP and EBP register overwrites.

Executive Summary:
Parallaxis Cuckoo Clock 5.0 contains a critical memory corruption flaw that allows attackers to execute arbitrary shellcode by exploiting the alarm scheduling function.

Vulnerability Details

CVE-ID: CVE-2020-37159

Affected Software: Parallaxis Cuckoo Clock

Affected Versions: 5.0

Vulnerability: The application suffers from a buffer overflow within the alarm scheduling feature. By submitting a malicious payload exceeding 260 bytes, an attacker can overwrite critical memory registers, including EIP and EBP, allowing for the execution of arbitrary shellcode with the privileges of the application.

Business Impact

A successful exploit could lead to full remote code execution on the host machine. The CVSS score of 9.8 indicates that the vulnerability is easily exploitable and results in a total loss of confidentiality, integrity, and availability for the affected system.

Remediation Plan

Immediate Action: Update the Parallaxis Cuckoo Clock software to the most recent version or decommission the software if it is no longer required for business operations.

Proactive Monitoring: Scan for anomalous payloads in application-specific configuration files and monitor for unexpected changes to the EIP/EBP registers during runtime.

Compensating Controls: Utilize Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) at the operating system level to mitigate the effectiveness of buffer overflow attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 7, 2026, there is no public information indicating active exploitation of this vulnerability. Despite its age, the technical simplicity of the overflow makes it a prime target for automated exploitation tools.

Analyst Recommendation

This vulnerability presents a critical risk to endpoint security due to the potential for arbitrary code execution. Users are urged to apply the vendor-provided updates immediately to secure their systems against memory corruption attacks.

---METADATA---
VENDOR: DBPower
PRODUCT: C300 HD Camera
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
DBPower C300 HD Camera contains a configuration disclosure vulnerability. Unauthenticated attackers can retrieve sensitive credentials via an unprotected configuration backup endpoint.

Executive Summary:
The DBPower C300 HD Camera suffers from a critical configuration disclosure vulnerability that allows unauthenticated attackers to steal sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2020-37157

Affected Software: DBPower C300 HD Camera

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves an unprotected configuration backup endpoint. An unauthenticated attacker can access this endpoint to download configuration files containing sensitive credentials and system settings without any form of authentication.

Business Impact

The impact of credential theft from an IoT device is severe, as it allows attackers to gain full administrative control over the camera. This could lead to unauthorized surveillance, loss of privacy, and the potential for the device to be recruited into a botnet. The CVSS score of 7.5 reflects the high risk associated with the ease of access to these sensitive credentials.

Remediation Plan

Immediate Action: Update the camera firmware to the latest version provided by DBPower to secure the backup endpoint.

Proactive Monitoring: Monitor for unusual outbound traffic from IoT devices and audit web server logs for hits on backup or configuration file paths.

Compensating Controls: Disable any unnecessary cloud or remote access features on the camera and ensure it is behind a robust firewall that restricts access to the web management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. This late-disclosure vulnerability is particularly dangerous because the exposure of credentials often leads to persistent access for attackers.

Analyst Recommendation

Immediate remediation is required to prevent the unauthorized disclosure of device credentials. Organizations and home users should verify firmware versions and ensure that these devices are not exposed to the public internet, as the unauthenticated nature of the flaw makes it highly exploitable.

---METADATA---
VENDOR: ASTPP
PRODUCT: Open Source Smart VoIP Billing Solution
AFFECTED_VERSIONS: 4.0.1
---END_METADATA---

Description Summary:
ASTPP 4.0.1 is vulnerable to XSS and command injection in SIP and plugin management interfaces, allowing attackers to hijack sessions and execute code with root permissions.

Executive Summary:
ASTPP 4.0.1 contains multiple critical flaws that enable attackers to gain root-level access and hijack administrator sessions through command injection and XSS.

Vulnerability Details

CVE-ID: CVE-2020-37153

Affected Software: ASTPP (Open Source Smart VoIP Billing Solution)

Affected Versions: 4.0.1

Vulnerability: The application suffers from multiple flaws including cross-site scripting (XSS) and command injection within the SIP device configuration and plugin management modules. Attackers can leverage these to inject system commands or manipulate cron tasks to achieve root-level code execution.

Business Impact

The compromise of a VoIP billing solution can lead to massive financial fraud, interception of sensitive communication data, and total system takeover. The CVSS score of 9.8 highlights the critical nature of these flaws, as they can lead to full administrative compromise and persistent access via cron manipulation.

Remediation Plan

Immediate Action: Upgrade ASTPP installations to the latest stable version where these vulnerabilities have been addressed.

Proactive Monitoring: Monitor system cron jobs for unauthorized changes and audit administrator session logs for suspicious activity or session hijacking indicators.

Compensating Controls: Use a WAF to filter malicious input in SIP configuration fields and enforce strict IP whitelisting for the management interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 11, 2026, there is no public information indicating active exploitation. This is a late disclosure of a 2020 vulnerability, suggesting that legacy systems may still be at risk.

Analyst Recommendation

Given the potential for root-level access and the sensitive nature of VoIP billing data, this vulnerability must be addressed with high urgency. Administrators should move away from version 4.0.1 immediately and conduct a thorough audit of their system configurations for any signs of past tampering.

---METADATA---
VENDOR: ACE Security
PRODUCT: WiP-90113 HD Camera
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability. Unauthenticated attackers can remotely retrieve sensitive configuration files from the device.

Executive Summary:
The ACE Security WiP-90113 HD Camera is vulnerable to an unauthenticated configuration disclosure flaw that allows attackers to steal sensitive device information.

Vulnerability Details

CVE-ID: CVE-2020-37146

Affected Software: ACE Security WiP-90113 HD Camera

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability is a configuration disclosure flaw that allows an unauthenticated, remote attacker to retrieve sensitive configuration files. The lack of proper access controls on the device's web interface enables the extraction of critical system settings.

Business Impact

The exposure of configuration files represents a critical privacy and security breach. Attackers can use the extracted data to gain deeper access to the camera, potentially viewing live feeds or using the device as a pivot point into the local network. With a CVSS score of 7.5, this vulnerability threatens the physical security and data privacy of the environment where the camera is deployed.

Remediation Plan

Immediate Action: Apply the latest firmware update from ACE Security to address the insecure configuration endpoint.

Proactive Monitoring: Inspect network traffic for unauthorized HTTP requests targeting configuration paths on IoT camera devices.

Compensating Controls: Place IP cameras on a segmented VLAN with no direct access to the internet and implement strict firewall rules to block unauthorized inbound traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. Despite being a late disclosure, the unauthenticated nature of the flaw makes it a high-priority target for automated scanners.

Analyst Recommendation

The ability for unauthenticated users to pull sensitive configuration data is a major security failure. Administrators must ensure that all ACE Security WiP-90113 cameras are updated immediately and isolated from public-facing networks to mitigate the risk of unauthorized surveillance or network intrusion.

---METADATA---
VENDOR: 10-Strike Software
PRODUCT: Network Inventory Explorer
AFFECTED_VERSIONS: 9.03
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the 10-Strike Network Inventory Explorer file import functionality allows remote attackers to execute arbitrary code via a malicious text file.

Executive Summary:
A critical buffer overflow vulnerability in 10-Strike Network Inventory Explorer allows remote attackers to execute arbitrary code by tricking a user into importing a malicious file.

Vulnerability Details

CVE-ID: CVE-2020-37138

Affected Software: 10-Strike Network Inventory Explorer

Affected Versions: 9.03

Vulnerability: The vulnerability exists in the file import feature. By crafting a malicious text file with a specifically constructed payload, an attacker can trigger a stack-based buffer overflow. This allows the attacker to bypass Data Execution Prevention (DEP) using a ROP chain and execute arbitrary code on the system.

Business Impact

Network Inventory Explorer is typically used by system administrators to manage corporate assets. A compromise of this tool could allow an attacker to gain administrative access to the management workstation, leading to the theft of network topology data, credentials, and potential lateral movement. The CVSS score of 9.8 underscores the severe impact of this RCE flaw.

Remediation Plan

Immediate Action: Update 10-Strike Network Inventory Explorer to the latest version. Avoid importing files from untrusted or unknown sources until the update is applied.

Proactive Monitoring: Use Endpoint Detection and Response (EDR) tools to monitor the Network Inventory Explorer process for suspicious child processes or memory anomalies.

Compensating Controls: Restrict the application's permissions to the minimum required for its function and use sandboxing for file import operations where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This 2020 vulnerability was disclosed in 2026. The use of ROP chains indicates a sophisticated exploitation path that can bypass modern OS protections like DEP.

Analyst Recommendation

Because this tool is central to asset management, its security is paramount. We recommend an immediate update to the latest version provided by 10-Strike Software. Administrators should be cautioned against importing inventory data from any source that has not been strictly verified, as this is the primary infection vector.

---METADATA---
VENDOR: AMSS++
PRODUCT: AMSS++
AFFECTED_VERSIONS: Version 4; See vendor advisory for additional details
---END_METADATA---

Description Summary:
AMSS++ version 4 is affected by a high-severity vulnerability. This late-disclosure entry indicates a significant security flaw within the application's core logic.

Executive Summary:
AMSS++ version 4 contains a high-severity security vulnerability that poses a significant risk to the integrity and availability of the affected system.

Vulnerability Details

CVE-ID: CVE-2020-37135

Affected Software: AMSS++

Affected Versions: AMSS++ 4

Vulnerability: This vulnerability affects AMSS++ version 4 and is characterized as a high-severity security flaw. Based on the late disclosure and CVSS score, the vulnerability likely permits an attacker to bypass security controls or execute unauthorized actions within the application environment.

Business Impact

The impact of this vulnerability is substantial, as evidenced by the CVSS score of 7.5. Successful exploitation could lead to unauthorized data access, system instability, or the compromise of administrative functions. For organizations utilizing this legacy software, the risk includes potential data loss and non-compliance with security standards due to the age and nature of the software.

Remediation Plan

Immediate Action: Users should immediately upgrade to a supported version of the software or apply specific vendor-provided patches for version 4.

Proactive Monitoring: Review system access logs for any historical signs of unauthorized logins or unusual administrative changes that may have occurred prior to this disclosure.

Compensating Controls: If patching is not immediately feasible, isolate the AMSS++ server from the public internet and restrict access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, this is a late disclosure of a 2020 vulnerability, which may mean exploitation techniques are already known in specialized circles.

Analyst Recommendation

Given the late disclosure and the high severity of the flaw, organizations must prioritize the remediation of AMSS++ installations. The most effective course of action is to migrate to a modern, supported platform or apply the necessary security updates to version 4 without delay.

---METADATA---
VENDOR: MEmu
PRODUCT: MEmu Play
AFFECTED_VERSIONS: 7.1.3
---END_METADATA---

Description Summary:
MEmu Play 7.1.3 contains an insecure folder permissions vulnerability allowing low-privileged users to replace the MemuService.exe file and gain SYSTEM-level privileges upon system restart.

Executive Summary:
MEmu Play 7.1.3 contains an insecure folder permissions flaw allowing low-privileged users to gain full SYSTEM-level access by replacing a critical service executable.

Vulnerability Details

CVE-ID: CVE-2020-37129

Affected Software: MEmu MEmu Play

Affected Versions: 7.1.3

Vulnerability: The application utilizes insecure file system permissions on its installation directory, specifically allowing low-privileged authenticated users to modify the MemuService.exe file. By replacing this executable with a malicious binary, an attacker can achieve local privilege escalation to SYSTEM level when the service restarts.

Business Impact

This vulnerability represents a significant internal threat, as it allows any user with basic access to the machine to gain total control over the operating system. Such an escalation can be used to disable security software, steal sensitive local data, or pivot further into the corporate network. The CVSS score of 9.8 underscores the critical impact of a local user gaining full administrative control.

Remediation Plan

Immediate Action: Update MEmu Play to the latest version, which addresses the directory permission issues, and verify that the "Everyone" or "Users" groups do not have write access to the installation folder.

Proactive Monitoring: Review system logs for unauthorized modifications to service executables and monitor for unexpected service restarts or new SYSTEM-level processes.

Compensating Controls: Utilize Endpoint Detection and Response (EDR) tools to block unauthorized file modifications in the Program Files directory and enforce the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, local privilege escalation vulnerabilities are frequently used by attackers after gaining an initial foothold in a network.

Analyst Recommendation

Organizations using MEmu Play must address this vulnerability immediately to prevent internal privilege escalation. We recommend auditing all third-party software installation directories for similar permission flaws. Applying the latest vendor patch is the most effective method to secure the service executable and maintain system integrity.

---METADATA---
VENDOR: Free Desktop Clock
PRODUCT: Desktop Clock
AFFECTED_VERSIONS: 3.0
---END_METADATA---

Description Summary:
Free Desktop Clock 3.0 contains a stack overflow vulnerability in the Time Zones display name input that allows unauthenticated attackers to overwrite SEH registers and execute arbitrary code.

Executive Summary:
Free Desktop Clock 3.0 is vulnerable to a critical stack overflow that allows unauthenticated attackers to execute arbitrary code via malicious Unicode input.

Vulnerability Details

CVE-ID: CVE-2020-37126

Affected Software: Free Desktop Clock Desktop Clock

Affected Versions: 3.0

Vulnerability: This vulnerability is a stack-based buffer overflow occurring within the Time Zones display name input field. An unauthenticated attacker can trigger this flaw by providing crafted Unicode input, leading to the overwriting of Structured Exception Handler (SEH) registers and subsequent arbitrary code execution.

Business Impact

A successful exploit allows for complete system compromise, as the attacker can gain the same execution privileges as the application. This could result in unauthorized data access, installation of malware, or total loss of system integrity. The CVSS score of 9.8 reflects the critical nature of this flaw due to the lack of required authentication and the potential for remote code execution.

Remediation Plan

Immediate Action: Administrators should immediately update Free Desktop Clock to the latest available version or decommission the software if it is no longer required for business operations.

Proactive Monitoring: Security teams should monitor for unusual application crashes or anomalous process behavior originating from the Desktop Clock executable.

Compensating Controls: Implement strict application whitelisting and ensure that users do not have administrative privileges, which can limit the scope of a successful code execution exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of triggering stack overflows via input fields, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it allows for unauthenticated remote code execution. Organizations should prioritize the removal or update of Free Desktop Clock 3.0 immediately. Given the age of the software and the critical CVSS score, immediate remediation is the only effective way to mitigate the risk of full system takeover.

---METADATA---
VENDOR: Edimax
PRODUCT: EW-7438RPn-v3 Mini
AFFECTED_VERSIONS: 1.27
---END_METADATA---

Description Summary:
An unauthenticated remote code execution vulnerability in the Edimax EW-7438RPn-v3 Mini allows attackers to execute arbitrary commands via the /goform/mp endpoint.

Executive Summary:
A critical unauthenticated remote code execution vulnerability in Edimax Wi-Fi extenders allows attackers to take full control of the device by sending crafted POST requests.

Vulnerability Details

CVE-ID: CVE-2020-37125

Affected Software: Edimax EW-7438RPn-v3 Mini

Affected Versions: 1.27

Vulnerability: The vulnerability is located in the /goform/mp web endpoint. It allows an unauthenticated attacker to perform command injection by sending a crafted POST request. This enables the attacker to download and execute malicious scripts directly on the device hardware.

Business Impact

Compromised Wi-Fi extenders can be used as persistent entry points into a corporate or home network. Attackers can perform man-in-the-middle attacks, sniff network traffic, or use the device as part of a botnet for DDoS attacks. The CVSS score of 9.8 reflects the ease of exploitation and the total compromise of the affected hardware.

Remediation Plan

Immediate Action: Update the firmware of the Edimax EW-7438RPn-v3 Mini to the latest version immediately. If the device is end-of-life, it should be replaced.

Proactive Monitoring: Monitor network traffic for unusual POST requests to the /goform/mp endpoint and watch for unauthorized outbound connections from IoT devices.

Compensating Controls: Place IoT devices like Wi-Fi extenders on a segregated VLAN with no access to sensitive internal resources or the management interfaces of other devices.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late disclosure of a 2020 vulnerability. Command injection in IoT devices is frequently targeted by automated malware like Mirai or its variants.

Analyst Recommendation

The ability for an unauthenticated attacker to execute commands remotely makes this a critical security risk. We recommend that organizations and individuals using these Edimax devices verify their firmware versions immediately. If a patch is not available from the vendor, the device should be decommissioned to prevent it from becoming a liability.

---METADATA---
VENDOR: B64dec
PRODUCT: B64dec Utility
AFFECTED_VERSIONS: 1.1.2
---END_METADATA---

Description Summary:
A buffer overflow in the B64dec utility allows attackers to execute arbitrary code by overwriting the Structured Exception Handler (SEH) during the base64 decoding process.

Executive Summary:
A critical buffer overflow in the B64dec utility allows attackers to execute arbitrary code on a system by providing crafted input during base64 decoding operations.

Vulnerability Details

CVE-ID: CVE-2020-37124

Affected Software: B64dec Utility

Affected Versions: 1.1.2

Vulnerability: The vulnerability occurs during the base64 decoding process when the utility handles malformed or overly long input. An attacker can use an "egg hunter" technique and a crafted payload to overwrite the Structured Exception Handler (SEH), leading to arbitrary code execution when the exception is triggered.

Business Impact

If this utility is used as part of an automated pipeline or by system administrators, its compromise can lead to the execution of malicious code with the privileges of the executing user. This could result in data theft, malware installation, or persistent access to the host system. The CVSS score of 9.8 reflects the high risk of code execution.

Remediation Plan

Immediate Action: Discontinue use of B64dec version 1.1.2 and update to a patched version or switch to a standard, well-maintained decoding library (e.g., those built into modern operating systems).

Proactive Monitoring: Scan for the presence of the B64dec binary on systems and monitor for unexpected crashes or shells spawned by the utility.

Compensating Controls: Use sandboxing or containerization when running small utilities that process untrusted input to limit the potential impact of a compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This 2020 vulnerability was disclosed in 2026. The mention of an "egg hunter" technique suggests that the exploit is designed to work even in memory-constrained environments.

Analyst Recommendation

Small utilities like B64dec are often overlooked in security audits but can provide a critical foothold for attackers. We recommend replacing this utility with a more secure alternative immediately. If its use is mandatory, ensure it is updated and that it never processes data from untrusted sources without strict input validation.

---METADATA---
VENDOR: Pinger
PRODUCT: Pinger
AFFECTED_VERSIONS: 1.0
---END_METADATA---

Description Summary:
Pinger 1.0 contains a remote code execution vulnerability where unauthenticated attackers can inject shell commands into the ping and socket parameters of ping.php to execute system commands.

Executive Summary:
Pinger 1.0 is susceptible to a critical remote code execution vulnerability through unsanitized input in the ping and socket parameters, allowing full server takeover.

Vulnerability Details

CVE-ID: CVE-2020-37123

Affected Software: Pinger Pinger

Affected Versions: 1.0

Vulnerability: This is a command injection vulnerability located in the ping.php file. An unauthenticated remote attacker can exploit unsanitized input in the 'ping' and 'socket' parameters by appending shell metacharacters, allowing them to write arbitrary PHP files to the server and execute OS-level commands.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary commands on the web server, leading to a total compromise of the application and underlying data. This could result in the theft of sensitive information, website defacement, or the use of the server as a botnet node. The CVSS score of 9.8 highlights the extreme risk posed by unauthenticated remote code execution.

Remediation Plan

Immediate Action: Update the Pinger software to the latest version immediately or disable the ping.php script if it is not essential for business operations.

Proactive Monitoring: Inspect web server access logs for requests to ping.php containing suspicious characters such as semicolons, pipes, or backticks (e.g., ;, |, `).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell command injection patterns in HTTP GET and POST parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, command injection flaws in web-facing scripts are highly attractive targets for automated exploitation scripts.

Analyst Recommendation

This vulnerability represents a critical risk to any organization hosting the affected software. Immediate patching or removal of the vulnerable script is required. Developers should ensure that all user-supplied input is strictly validated against an allow-list and that system calls are made using secure APIs rather than direct shell execution.

---METADATA---
VENDOR: Rubo Medical Imaging
PRODUCT: Rubo DICOM Viewer
AFFECTED_VERSIONS: 2.0
---END_METADATA---

Description Summary:
A buffer overflow in the Rubo DICOM Viewer server name input field allows attackers to overwrite the Structured Exception Handler (SEH) and execute arbitrary code.

Executive Summary:
A critical buffer overflow in Rubo DICOM Viewer allows attackers to execute arbitrary code remotely by exploiting an improperly handled input field in the DICOM server configuration.

Vulnerability Details

CVE-ID: CVE-2020-37120

Affected Software: Rubo DICOM Viewer

Affected Versions: 2.0

Vulnerability: The vulnerability exists in the DICOM server name input field. An attacker can provide a specially crafted string—potentially via a malicious configuration file or direct input—that overflows the buffer, overwrites the Structured Exception Handler (SEH), and redirects execution to an attacker-controlled payload.

Business Impact

In a medical environment, the compromise of a DICOM viewer can lead to the theft of Protected Health Information (PHI) or the manipulation of medical records. A successful exploit grants the attacker the same privileges as the user running the viewer, often leading to full workstation compromise. The CVSS score of 9.8 highlights the critical nature of this flaw.

Remediation Plan

Immediate Action: Update Rubo DICOM Viewer to the latest version. If the software is no longer supported, migrate to a secure, modern DICOM viewing solution.

Proactive Monitoring: Review system logs for application crashes related to the DICOM viewer and monitor for unauthorized network connections originating from medical imaging workstations.

Compensating Controls: Implement strict application whitelisting and restrict the ability of the viewer to process files from untrusted or external sources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This 2020 vulnerability was disclosed late in 2026. The use of SEH overwrite is a classic exploitation technique, suggesting that a functional exploit could be developed easily by motivated actors.

Analyst Recommendation

Healthcare organizations must prioritize the security of medical imaging software. We recommend an immediate audit of all workstations running Rubo DICOM Viewer 2.0. Given the sensitivity of medical data, the software should be updated or replaced immediately to prevent remote code execution and potential HIPAA violations.

---METADATA---
VENDOR: Nsauditor
PRODUCT: Nsauditor (Network Security Auditor)
AFFECTED_VERSIONS: 3.0.28, 3.2.1.0
---END_METADATA---

Description Summary:
A buffer overflow in the Nsauditor DNS Lookup tool allows attackers to bypass ASLR and execute arbitrary shellcode via a crafted DNS query payload.

Executive Summary:
A critical buffer overflow vulnerability in Nsauditor allows remote attackers to execute arbitrary code and gain full control of the host system by exploiting the DNS Lookup tool.

Vulnerability Details

CVE-ID: CVE-2020-37119

Affected Software: Nsauditor

Affected Versions: 3.0.28, 3.2.1.0

Vulnerability: The DNS Lookup tool within Nsauditor fails to properly validate the size of incoming DNS query responses. This allows an attacker to send a malicious payload that triggers a three-byte overwrite, enabling them to bypass Address Space Layout Randomization (ASLR) and execute arbitrary shellcode.

Business Impact

Successful exploitation results in complete system compromise. Since Nsauditor is a security auditing tool often run with elevated privileges, an attacker gaining code execution could potentially compromise the entire network being audited. The CVSS score of 9.8 reflects the high probability of successful remote exploitation and total impact on confidentiality and integrity.

Remediation Plan

Immediate Action: Update Nsauditor to the latest available version. If a patch is unavailable, discontinue use of the DNS Lookup tool within the application.

Proactive Monitoring: Monitor for unusual outbound DNS traffic or crashes of the Nsauditor process, which may indicate failed exploitation attempts.

Compensating Controls: Use network-level DNS filtering and ensure that the host running Nsauditor is isolated from untrusted networks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late-disclosure vulnerability from 2020, published in 2026. While no active exploitation is currently reported, the technical details provided make the creation of an exploit highly feasible.

Analyst Recommendation

The delay in disclosure increases the risk that legacy systems remain vulnerable. We recommend that security teams immediately identify any installations of Nsauditor and apply updates. Because this tool is used for security auditing, its compromise would be particularly damaging to the organization's overall security posture.

---METADATA---
VENDOR: GUnet
PRODUCT: OpenEclass
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
GUnet OpenEclass 1 is affected by a critical security vulnerability that could lead to a complete system compromise or unauthorized data access.

Executive Summary:
A critical vulnerability in GUnet OpenEclass 1 poses a severe risk to the platform, potentially allowing unauthenticated attackers to gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2020-37116

Affected Software: GUnet OpenEclass

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects GUnet OpenEclass version 1. Similar to CVE-2020-37113, the CVSS score of 8.8 suggests a critical failure in input validation or access control, potentially allowing for remote code execution (RCE) by an unauthenticated user.

Business Impact

The impact of an 8.8 CVSS score vulnerability is catastrophic, potentially resulting in a total loss of confidentiality, integrity, and availability. Attackers could gain access to sensitive academic records, disrupt online learning, or use the server for malicious activities, leading to significant legal and reputational consequences.

Remediation Plan

Immediate Action: Update GUnet OpenEclass to the latest patched version immediately to remediate this critical security hole.

Proactive Monitoring: Implement robust logging and alerting for any attempts to access sensitive system files or execute shell commands through the web interface.

Compensating Controls: Ensure the web server is running with the least privilege necessary and that all software dependencies are up to date.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. The high severity indicates that if a technique is discovered, exploitation would likely be highly effective and damaging.

Analyst Recommendation

This vulnerability represents a critical risk to the organization. Immediate application of the vendor's security patch is mandatory to mitigate the threat of a full system takeover and to ensure the continued safety of user data.

---METADATA---
VENDOR: GUnet
PRODUCT: OpenEclass
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
GUnet OpenEclass 1 is affected by a critical security vulnerability that could allow for unauthorized file access or remote code execution.

Executive Summary:
GUnet OpenEclass 1 contains a critical vulnerability that may allow an attacker to fully compromise the e-learning platform and its associated data.

Vulnerability Details

CVE-ID: CVE-2020-37113

Affected Software: GUnet OpenEclass

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists in GUnet OpenEclass version 1. The CVSS score of 8.8 indicates a critical flaw, likely involving an unauthenticated attacker's ability to perform arbitrary file operations or execute code on the server.

Business Impact

Successful exploitation could lead to the theft of student and educator data, the modification of educational content, and the use of the platform to distribute malware. A CVSS score of 8.8 justifies an extremely high severity rating, as it implies the attacker can achieve significant control over the system with minimal effort.

Remediation Plan

Immediate Action: Apply the latest security updates provided by GUnet for the OpenEclass platform immediately.

Proactive Monitoring: Monitor for suspicious file uploads or modifications within the web root and review system logs for unauthorized user creation.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect all incoming traffic for malicious payloads and restrict file upload directories to prevent execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. However, the high CVSS score and the educational nature of the software make it an attractive target for data theft.

Analyst Recommendation

Given the critical CVSS score of 8.8, this vulnerability must be addressed with the highest priority. Immediate patching is the only reliable way to protect the platform from potential remote exploitation and data exfiltration.

---METADATA---
VENDOR: 60CycleCMS
PRODUCT: 60CycleCMS
AFFECTED_VERSIONS: Version 2; See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists in 60CycleCMS version 2 that could allow for unauthorized system compromise. Technical details suggest a significant flaw in the application's core logic.

Executive Summary:
60CycleCMS version 2 is affected by a high-severity vulnerability that poses a significant risk of unauthorized access and data compromise.

Vulnerability Details

CVE-ID: CVE-2020-37110

Affected Software: 60CycleCMS 60CycleCMS

Affected Versions: Version 2

Vulnerability: This vulnerability affects version 2 of the 60CycleCMS platform. While specific technical vectors are limited in initial disclosures, the high severity indicates a flaw likely accessible by an unauthenticated or low-privileged attacker targeting the CMS framework.

Business Impact

A successful exploit of this vulnerability could lead to a total compromise of the CMS environment, including the theft of sensitive data, unauthorized content modification, and potential lateral movement within the hosting infrastructure. The CVSS score of 8.2 reflects a High severity rating, highlighting the substantial risk to organizational integrity and availability of web services.

Remediation Plan

Immediate Action: Administrators should immediately apply the latest security patches provided by 60CycleCMS or upgrade to a supported, non-vulnerable version of the software.

Proactive Monitoring: Security teams should monitor web server access logs for unusual POST requests or directory traversal attempts targeting the CMS installation directory.

Compensating Controls: Implementing a Web Application Firewall (WAF) with generic CMS protection rules can help mitigate exploitation attempts until the primary patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, this is a late disclosure of a 2020 flaw; the potential for exploitation remains high as technical details become more widely known.

Analyst Recommendation

The high CVSS score of 8.2 necessitates immediate attention from security administrators. We strongly recommend prioritizing the patching of all 60CycleCMS v2 instances to prevent unauthorized access and potential data exfiltration.