Description Summary:
Unified Remote contains a remote code execution vulnerability where unauthenticated attackers can send crafted packets to port 9512 to execute arbitrary commands.

Executive Summary:
Unified Remote 3.9.0.2463 is vulnerable to unauthenticated remote code execution, allowing attackers to take full control of the host system.

Vulnerability Details

CVE-ID: CVE-2021-47891

Affected Software: Unified Intents AB Unified Remote

Affected Versions: 3.9.0.2463

Vulnerability: The application lacks proper authentication for critical functions (CWE-306). By sending specially crafted network packets to port 9512, an unauthenticated, remote attacker can trigger command execution on the underlying host.

Business Impact

This is a critical vulnerability that allows for complete system compromise, including the potential for data exfiltration, malware installation, and long-term persistence. With a CVSS score of 9.8, the ability for an unauthenticated attacker to execute arbitrary commands poses an immediate threat to the entire network segment where the software is deployed.

Remediation Plan

Immediate Action: Update Unified Remote to the latest available version provided by the vendor. If an update is not immediately available, disable the service or restrict network access to port 9512 to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual payloads targeting port 9512 and audit system logs for unexpected command execution or process creation.

Compensating Controls: Utilize a firewall to strictly control ingress traffic to the service port, ensuring only authorized management workstations can communicate with the application.

Exploitation Status

Public Exploit Available: Yes — ExploitDB (ID 49587)

Analyst Notes: As of Jan 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit in ExploitDB significantly lowers the barrier for attackers to weaponize this flaw.

Analyst Recommendation

The presence of a public exploit combined with the ease of remote code execution makes this a high-urgency issue. Immediate remediation or network isolation is required to prevent potential compromise of systems running the affected version.

Description Summary:
LogonExpert 8.1 is vulnerable to an unquoted service path flaw in the LogonExpertSvc service, which runs with LocalSystem privileges.

Executive Summary:
An unquoted service path vulnerability in Softros Systems LogonExpert 8.1 allows local attackers to achieve privilege escalation by placing malicious executables in the service path.

Vulnerability Details

CVE-ID: CVE-2021-47890

Affected Software: Softros Systems LogonExpert

Affected Versions: 8.1

Vulnerability: This is a local privilege escalation vulnerability (CWE-428) involving an unquoted service path for the LogonExpertSvc service. An attacker with local access can exploit the lack of quotes in the executable path to execute arbitrary code with LocalSystem privileges during service startup.

Business Impact

Successful exploitation of this vulnerability results in full system compromise, as the affected service runs with the highest possible level of local privilege. This allows an attacker to install programs, view, change, or delete data, and create new accounts with full user rights. Given the CVSS score of 7.8, this represents a high risk to the confidentiality, integrity, and availability of any system where the software is installed.

Remediation Plan

Immediate Action: As no specific patch version is documented in the provided data, administrators should contact Softros Systems support to verify if a patched version is available or if a manual configuration change is recommended.

Proactive Monitoring: Monitor system logs for the creation of unexpected executable files within the C:\Program Files\Softros Systems\ directory structure.

Compensating Controls: Ensure that standard users lack write permissions to the C:\Program Files\ and C:\Program Files (x86)\ directories to prevent the placement of malicious binaries in the vulnerable path.

Exploitation Status

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via the Exploit Database (EDB-ID 49586).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit for any user with local access to the file system.

Analyst Recommendation

Given the high severity and the availability of a public proof-of-concept, users of LogonExpert 8.1 must prioritize securing the service path or upgrading the software if a fix is provided by the vendor. Restricting local user permissions to prevent unauthorized file creation in system directories is a critical interim measure to mitigate the risk of privilege escalation.

Description Summary:
Softros LAN Messenger 9.6.4 is vulnerable to an unquoted service path issue in the SoftrosSpellChecker service, which could allow a local attacker to execute arbitrary code with elevated privileges.

Executive Summary:
A local privilege escalation vulnerability exists in Softros LAN Messenger 9.6.4, allowing attackers to execute arbitrary code via an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47889

Affected Software: Softros Systems LAN Messenger

Affected Versions: 9.6.4

Vulnerability: The application contains an unquoted service path vulnerability within the SoftrosSpellChecker service. This flaw allows a local, authenticated attacker to place a malicious executable in the path hierarchy, which the system will execute with LocalSystem privileges during the service startup process.

Business Impact

Successful exploitation of this vulnerability allows a local attacker to escalate their privileges to the highest level on the host system. This could lead to a total compromise of the affected machine, including unauthorized access to sensitive data, the installation of persistent backdoors, and the potential for lateral movement within the network. The CVSS score of 7.8 reflects the high severity of achieving full system control via local access.

Remediation Plan

Immediate Action: Update Softros LAN Messenger to the latest available version provided by the vendor to resolve the service path configuration. If an update is not immediately available, administrators should manually modify the service path registry entry to include quotes around the executable path.

Proactive Monitoring: Review system event logs for unexpected service restarts or failures related to the SoftrosSpellChecker service. Monitor file system activity within the C:\Program Files (x86)\Softros Systems\ directory for the creation of unauthorized or suspicious executable files.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent non-privileged users from creating or modifying files within the Softros Messenger path. Utilize Endpoint Detection and Response (EDR) solutions to alert on suspicious process spawning from service paths.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 49588).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is a classic unquoted service path flaw, which is inherently easy to exploit once an attacker has local access to the file system.

Analyst Recommendation

This vulnerability presents a significant risk to local system integrity by enabling unauthorized privilege escalation. Administrators must prioritize updating the software or applying the manual registry fix to secure the service path. Failure to address this flaw leaves the host susceptible to full administrative compromise by local users.

Description Summary:
Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability allowing users to upload and execute malicious PHP files via the file management interface.

Executive Summary:
An authenticated remote code execution vulnerability in Textpattern versions prior to 4.8.3 allows attackers with valid credentials to gain full control over the underlying server.

Vulnerability Details

CVE-ID: CVE-2021-47888

Affected Software: Textpattern Textpattern

Affected Versions: Versions prior to 4.8.3

Vulnerability: This flaw is categorized as an unrestricted upload of a file with a dangerous type (CWE-434). An authenticated user can bypass intended restrictions to upload a PHP shell and execute arbitrary commands by accessing the file through a specific URL parameter.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the hosting server with the privileges of the web application. This could lead to a complete compromise of the web server, unauthorized access to sensitive application data, and potential lateral movement within the network. Given the CVSS score of 8.8, this vulnerability poses a high risk to organizational security and system integrity.

Remediation Plan

Immediate Action: Update the Textpattern installation to version 4.8.3 or later to resolve the file upload validation flaw.

Proactive Monitoring: Monitor server access logs for requests to files within the uploads or files directory that contain unexpected parameters, such as the cmd parameter used in known exploits.

Compensating Controls: Implement strict file type filtering at the Web Application Firewall (WAF) level to block the upload of executable scripts like .php files to directories where they are not intended to be executed.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists, specifically a Python-based exploit script available via ExploitDB (EDB-ID: 49620).

Analyst Notes: As of January 25, 2026, there is no public information indicating active exploitation in the wild, though a functional proof of concept is available. The vulnerability is highly exploitable once an attacker has obtained authenticated access to the system.

Analyst Recommendation

The presence of a weaponized proof of concept necessitates urgent attention to this vulnerability. Administrators should prioritize upgrading to version 4.8.3 immediately to eliminate the underlying code execution vector. If an immediate upgrade is not feasible, restrict access to the file management interface to highly trusted users and monitor file system changes for unauthorized script creation.

Description Summary:
OKI Print Job Accounting 4.4.10 contains an unquoted service path vulnerability in the OkiJaSvc service, which allows local attackers to execute arbitrary code and escalate privileges.

Executive Summary:
A local privilege escalation vulnerability exists in OKI Print Job Accounting 4.4.10 due to an unquoted service path, posing a significant risk of arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2021-47887

Affected Software: OKI Print Job Accounting

Affected Versions: 4.4.10

Vulnerability: The software utilizes an unquoted service path for the OkiJaSvc service. A local attacker with low privileges can exploit this by placing a malicious executable in the directory path to hijack the service execution and gain elevated system privileges.

Business Impact

Successful exploitation allows a local, authenticated attacker to execute arbitrary code with SYSTEM-level privileges. This effectively compromises the confidentiality, integrity, and availability of the host machine. Given the CVSS score of 7.8, this flaw represents a high-severity risk to internal security, as it facilitates lateral movement and full system takeover once an initial foothold is established.

Remediation Plan

Immediate Action: Administrators should immediately update to the latest available version of the software provided by OKI or apply the specific configuration hardening recommended by the vendor to quote the service path.

Proactive Monitoring: Review Windows Service configurations using tools like PowerShell (Get-WmiObject Win32_Service) to identify and remediate any instances of unquoted service paths within the environment.

Compensating Controls: Implement strict file system permissions on the C:\Program Files\Okidata\ directory to prevent unauthorized users from creating files or subdirectories that could be leveraged for service path hijacking.

Exploitation Status

Public Exploit Available: Yes, a public exploit exists as documented in the Exploit Database (EDB-ID: 49623).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly reliable for local privilege escalation due to the predictable nature of Windows service path resolution.

Analyst Recommendation

This vulnerability presents a clear path for privilege escalation on Windows systems running the affected OKI software. Security teams must prioritize identifying all instances of Print Job Accounting 4.4.10 and ensuring they are updated or that the service paths are manually quoted to mitigate the risk of unauthorized code execution.

Description Summary:
Pingzapper 2.3.1 is vulnerable to an unquoted service path issue in the PingzapperSvc service, which could allow a local attacker to execute arbitrary code and escalate privileges.

Executive Summary:
A local privilege escalation vulnerability exists in Pingzapper 2.3.1 due to an unquoted service path, posing a significant risk of arbitrary code execution on affected Windows systems.

Vulnerability Details

CVE-ID: CVE-2021-47886

Affected Software: Fyrolabs LLC Pingzapper

Affected Versions: 2.3.1

Vulnerability: The application utilizes an unquoted service path for the PingzapperSvc service, specifically C:\Program Files (x86)\Pingzapper\PZService.exe. This flaw allows a local, authenticated attacker to place a malicious executable in a directory that the service path resolves to, leading to privilege escalation when the service executes.

Business Impact

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with SYSTEM level privileges. This compromises the integrity and confidentiality of the host operating system, potentially leading to full system takeover, unauthorized access to sensitive data, and the deployment of persistent malware. Given the CVSS score of 7.8, this represents a high-severity risk that requires immediate attention for all deployments running the affected version.

Remediation Plan

Immediate Action: Upgrade to the latest available version of Pingzapper provided by Fyrolabs LLC to ensure the service path is properly quoted or remediated.

Proactive Monitoring: Audit Windows services for unquoted service paths and monitor system logs for unusual process creation events originating from the service control manager.

Compensating Controls: Restrict write permissions on the directory paths associated with services to prevent unauthorized users from placing malicious executables in the path hierarchy.

Exploitation Status

Public Exploit Available: Yes, a functional local exploit is documented on Exploit-DB (EDB-ID 49626).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is a classic unquoted service path flaw, which is inherently easy to exploit once a user gains low-level local access to the file system.

Analyst Recommendation

The presence of a public exploit and the potential for full system compromise via privilege escalation necessitate urgent remediation. Organizations should verify their current version of Pingzapper and apply the vendor-supplied update immediately. If an update is not immediately feasible, system administrators should manually ensure that service paths are correctly quoted in the Windows Registry to mitigate this attack vector.

Description Summary:
OKI Configuration Tool 1.6.53 contains an unquoted service path vulnerability in the OKI Local Port Manager service, allowing local attackers to escalate privileges via malicious executable injection.

Executive Summary:
A local privilege escalation vulnerability in the OKI Configuration Tool, version 1.6.53, allows attackers to execute arbitrary code by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47884

Affected Software: OKI Configuration Tool

Affected Versions: 1.6.53

Vulnerability: The application utilizes an unquoted service path for the OKI Local Port Manager service, which lacks proper encapsulation in the binary execution path. A local, low-privileged attacker can place a malicious executable in a directory that precedes the intended binary, causing the service to execute the attacker-controlled file with system-level permissions.

Business Impact

The vulnerability carries a CVSS score of 7.8, reflecting its potential for full system compromise. If exploited, an attacker can gain administrative or system-level control over the host machine, leading to unauthorized data access, the installation of persistent malware, and potential lateral movement within the corporate network.

Remediation Plan

Immediate Action: Administrators should update the OKI Configuration Tool to the latest available version or, if no patch is provided by the vendor, disable the vulnerable "OKI Local Port Manager" service if it is not strictly required for business operations.

Proactive Monitoring: Security teams should monitor for the creation of unauthorized executable files within the "C:\Program Files\Okidata" directory structure and audit service configurations for unquoted paths using tools like WMIC or PowerShell.

Compensating Controls: Implement strict file system permissions on the application installation directory to prevent non-administrative users from writing or modifying files within the "Okidata" folder path.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID 49624).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because Windows service control managers interpret unquoted paths with spaces as multiple potential executable targets.

Analyst Recommendation

Given the severity of potential privilege escalation and the existence of a public proof-of-concept, this vulnerability poses a significant risk to affected workstations. IT administrators should prioritize identifying installations of OKI Configuration Tool 1.6.53 and apply the vendor-recommended updates or disable the vulnerable service immediately to mitigate the risk of local system compromise.

Description Summary:
Sandboxie Plus 0.7.2 is vulnerable to an unquoted service path flaw in the SbieSvc service, allowing local attackers to execute arbitrary code with elevated LocalSystem privileges.

Executive Summary:
A local privilege escalation vulnerability in Sandboxie Plus 0.7.2 allows attackers to execute code as LocalSystem by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47883

Affected Software: Sandboxie Sandboxie Plus

Affected Versions: 0.7.2

Vulnerability: This is an unquoted service path vulnerability (CWE-428) located in the SbieSvc service. An attacker with local access can place a malicious executable in the path of the service, which the system will then execute with elevated LocalSystem permissions during service startup.

Business Impact

The ability for a local user to gain LocalSystem privileges represents a complete compromise of the affected host. This severity, reflected by a CVSS score of 7.8, indicates that an attacker could bypass all standard user restrictions, install persistent backdoors, or exfiltrate sensitive data from the machine.

Remediation Plan

Immediate Action: Update to a version of Sandboxie Plus later than 0.7.2, as this specific release is confirmed to be vulnerable.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or the creation of suspicious executables in the C:\Program Files\ directory tree.

Compensating Controls: Ensure that directory permissions for the installation path of Sandboxie Plus are strictly limited to prevent non-privileged users from creating or modifying files within the application folder.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in ExploitDB entry 49631.

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user capable of writing to the affected directory path.

Analyst Recommendation

Given the ease with which an attacker can escalate privileges from a standard user to LocalSystem, this vulnerability poses a significant risk to environment integrity. Administrators should prioritize updating the Sandboxie Plus software immediately to remediate the unquoted service path, as the existence of a public proof-of-concept significantly lowers the barrier for potential exploitation.

Description Summary:
FreeLAN 2.2 contains an unquoted service path vulnerability on Windows that allows local attackers to execute arbitrary code with LocalSystem privileges.

Executive Summary:
A vulnerability in the FreeLAN 2.2 Windows service configuration allows local attackers to achieve privilege escalation by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47882

Affected Software: FreeLAN FreeLAN

Affected Versions: 2.2

Vulnerability: The application is susceptible to an unquoted service path vulnerability (CWE-428) where the service binary path lacks proper quotation marks. This allows a local attacker to place a malicious executable in a directory that the service path traverses, resulting in code execution with LocalSystem privileges upon service startup.

Business Impact

The ability for a local attacker to gain LocalSystem privileges represents a total compromise of the affected host. This vulnerability could allow an attacker to bypass security controls, install persistent backdoors, or access sensitive data across the system. Given the CVSS score of 7.8, this flaw poses a significant risk to the confidentiality, integrity, and availability of any system running the vulnerable software.

Remediation Plan

Immediate Action: Since no specific patch is identified in the provided data, administrators should manually move the FreeLAN service binary to a secure location or apply proper quotation marks to the registry path for the "FreeLAN Service" to prevent unauthorized binary hijacking.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service startup failures or the creation of new, unrecognized executables within the "C:\Program Files" directory structure.

Compensating Controls: Restrict local user write permissions on the "C:\Program Files" and "C:\Program Files\FreeLAN" directories to prevent unauthorized binary placement.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exploit is available via ExploitDB (EDB-ID: 49630).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any local user with sufficient filesystem permissions to drop a malicious file into the vulnerable path.

Analyst Recommendation

This vulnerability presents a high risk due to the potential for full system compromise via privilege escalation. Organizations currently running FreeLAN 2.2 must prioritize restricting filesystem access to the application directories as a primary defense. Until a vendor-supplied patch is confirmed, manual remediation of the service path configuration is essential to neutralize this attack vector.

Description Summary:
Data Device Corporation dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code via a malicious text file.

Executive Summary:
A local buffer overflow vulnerability in Data Device Corporation dataSIMS Avionics ARINC 664-1 version 4.5.3 poses a severe risk of arbitrary code execution on affected Windows systems.

Vulnerability Details

CVE-ID: CVE-2021-47881

Affected Software: Data Device Corporation dataSIMS Avionics ARINC 664-1

Affected Versions: 4.5.3

Vulnerability: This is a stack-based buffer overflow (CWE-121) triggered by the application when it processes a specially crafted milstd1553result.txt file. An attacker with local access can manipulate this file to overwrite memory, potentially leading to arbitrary code execution with the privileges of the user running the software.

Business Impact

The exploitation of this vulnerability could allow an unauthorized local user to gain control over the host system, leading to a total compromise of system integrity and confidentiality. Given the specialized nature of avionics simulation software, such a breach could result in the corruption of critical testing data or unauthorized access to sensitive aerospace configuration files. With a CVSS score of 8.4, this vulnerability represents a high-risk security flaw that requires immediate attention in environments where this software is deployed.

Remediation Plan

Immediate Action: Users should update to the latest available version of the software provided by Data Device Corporation that addresses this memory corruption flaw.

Proactive Monitoring: Security teams should monitor file integrity for the milstd1553result.txt file and review system logs for signs of anomalous application crashes or unauthorized process execution.

Compensating Controls: Ensure that the software is executed with the least privilege necessary and restrict write access to the directory where the application processes its input files to prevent unauthorized file modification.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists in the form of a Python script published on Exploit-DB (EDB-ID: 49577).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the application fails to properly validate the size of the input provided within the milstd1553result.txt file before copying it into a fixed-length memory buffer.

Analyst Recommendation

This vulnerability presents a clear risk to systems utilizing dataSIMS Avionics software. Organizations must prioritize updating the affected software to the vendor-patched version to eliminate the buffer overflow condition. If an update cannot be applied immediately, restrict access to the host system to trusted users only and implement strict file system permissions to prevent the placement of malicious input files.

Description Summary:
Realtek Wireless LAN Utility 700.1631 contains an unquoted service path vulnerability that allows local users to execute code with elevated system privileges.

Executive Summary:
A vulnerability in the Realtek Wireless LAN Utility allows local attackers to escalate privileges to the system level by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47880

Affected Software: Realtek Wireless LAN Utility

Affected Versions: 700.1631

Vulnerability: The application utilizes an unquoted service path for the Realtek11nSU service, which runs with LocalSystem privileges. A local attacker can exploit this by placing a malicious executable in a directory within the path, causing the service to execute the attacker's code upon startup or reboot.

Business Impact

The ability for a local user to execute code with elevated system privileges represents a significant security failure. Successful exploitation grants the attacker full control over the affected machine, potentially leading to unauthorized data access, the installation of persistent backdoors, or lateral movement within the network. This risk is underscored by the CVSS score of 7.8, which reflects the high severity of potential system-level compromise.

Remediation Plan

Immediate Action: Since no official patch is confirmed, administrators should restrict folder permissions on the affected system paths to prevent unauthorized writes, or uninstall the utility if it is not business-critical.

Proactive Monitoring: Monitor system logs for the execution of unexpected binaries from the C:\Program Files (x86)\Realtek\Wireless LAN Utility\ directory and audit service configurations for unquoted paths.

Compensating Controls: Use Group Policy Objects (GPO) to enforce strict file system permissions on the installation directory, ensuring that only administrators have write access to the path.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49646.

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user with the ability to write to the file system.

Analyst Recommendation

Given the potential for full system compromise, organizations should treat this vulnerability with high priority. If the software cannot be uninstalled, immediate steps must be taken to secure the directory permissions to prevent local attackers from placing malicious payloads. Ensure that security teams monitor for any unauthorized changes to the service configuration or the creation of suspicious executables within the application directory.

Description Summary:
Luidia eBeam Interactive Suite 3.6 contains an unquoted service path vulnerability in the eBeam Stylus Driver service that allows local users to execute code with elevated system privileges.

Executive Summary:
A local privilege escalation vulnerability exists in Luidia eBeam Interactive Suite 3.6 due to an unquoted service path, potentially allowing attackers to execute malicious code as LocalSystem.

Vulnerability Details

CVE-ID: CVE-2021-47879

Affected Software: Luidia eBeam Interactive Suite

Affected Versions: 3.6

Vulnerability: The vulnerability involves an unquoted service path in the eBeam Stylus Driver service. A local attacker can exploit this by placing a malicious executable in a specific directory along the path, which the system will then execute with elevated LocalSystem permissions upon service startup.

Business Impact

Successful exploitation of this vulnerability allows a local user to gain full administrative control over the affected system. This poses a significant security risk, as it facilitates unauthorized access to sensitive data, potential installation of persistent backdoors, and total compromise of the host machine's integrity. Given the CVSS score of 7.8, this is considered a high-severity issue that requires prompt attention to prevent lateral movement within the network.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should manually modify the service path registry key for the eBeam Stylus Driver to include quotes around the executable path. Alternatively, if the software is not mission-critical, uninstall the application until the vendor provides a secure update.

Proactive Monitoring: Monitor system logs for unexpected service restarts or the creation of unauthorized executables within the C:\Program Files (x86)\Luidia\ directory. Review logs for any unusual activity associated with the eBeam Stylus Driver service.

Compensating Controls: Implement strict file system permissions to prevent low-privileged users from writing files to the Luidia installation directory. Ensure that Endpoint Detection and Response (EDR) solutions are configured to alert on unauthorized attempts to modify system services.

Exploitation Status

Public Exploit Available: Yes, a local exploit is available via Exploit-DB (EDB-ID 49648).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any local user with sufficient permissions to write to the vulnerable directory path.

Analyst Recommendation

Due to the risk of local privilege escalation and the availability of public exploit code, this vulnerability should be addressed immediately. Administrators should prioritize securing the service path configuration or removing the affected software to mitigate the risk of full system compromise by local attackers.

Description Summary:
The eBeam Device Service in eBeam Education Suite 2.5.0.9 contains an unquoted service path vulnerability, allowing local users to execute code with elevated system privileges.

Executive Summary:
A local privilege escalation vulnerability in Luidia eBeam Education Suite 2.5.0.9 allows attackers to execute arbitrary code with LocalSystem privileges.

Vulnerability Details

CVE-ID: CVE-2021-47878

Affected Software: Luidia eBeam Education Suite

Affected Versions: 2.5.0.9

Vulnerability: The application utilizes an unquoted service path for the eBeam Device Service. By placing a malicious executable in a specific directory along the unquoted path, a local user can trigger the execution of arbitrary code with LocalSystem privileges during service startup.

Business Impact

This vulnerability carries a CVSS score of 7.8, reflecting its significant risk to local system integrity. Successful exploitation grants an attacker full control over the affected workstation, enabling the installation of malware, theft of sensitive local data, or further movement within the network. This represents a severe threat to organizations using the affected suite in classroom or office environments.

Remediation Plan

Immediate Action: Since no official patch is available, administrators should manually apply quotes to the service path via the Windows Registry or disable the eBeam Device Service if it is not required for daily operations.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or the creation of suspicious executable files within the Program Files directory structure.

Compensating Controls: Implement strict file system permissions to prevent unprivileged users from writing files to the directory paths used by system services, effectively neutralizing the ability to plant malicious binaries.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 49647).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently easy to exploit for any user with local access who can modify the vulnerable directory path.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high severity of potential privilege escalation, organizations must treat this vulnerability with urgency. Administrators should prioritize securing the service configuration on all affected endpoints to prevent unauthorized local users from gaining administrative control over the host.

Description Summary:
GeoGebra Graphing Calculator 6.0.631.0 is susceptible to a denial of service vulnerability due to improper input validation, allowing attackers to crash the application with oversized buffers.

Executive Summary:
A denial of service vulnerability in GeoGebra Graphing Calculator 6.0.631.0 allows local attackers to crash the application by supplying an oversized input string.

Vulnerability Details

CVE-ID: CVE-2021-47877

Affected Software: GeoGebra Graphing Calculator

Affected Versions: 6.0.631.0

Vulnerability: The application fails to properly throttle or limit resource allocation, specifically within an input field. By injecting a payload of 8000 repeated characters, an unauthenticated local attacker can overwhelm the application and force an unresponsive state.

Business Impact

Successful exploitation of this vulnerability results in an application crash, leading to a denial of service for the local user. While the CVSS score of 7.5 indicates a high severity due to the impact on application availability, the risk is localized to the machine where the software is installed. This could disrupt academic or professional workflows that rely on the calculator, causing temporary productivity loss.

Remediation Plan

Immediate Action: There is no official patch currently documented for this specific version. Users should restrict access to the application on shared systems or upgrade to the latest available version of the GeoGebra suite to determine if the issue has been addressed in subsequent releases.

Proactive Monitoring: Monitor system event logs and application crash reports for recurring termination errors associated with the GeoGebra executable.

Compensating Controls: Since this is a local application, ensure that users operate with the principle of least privilege, limiting the ability of unauthorized local users to interact with sensitive or critical software installations.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 49653).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is straightforward to trigger, requiring only the input of a specifically crafted string into the application interface.

Analyst Recommendation

Given the availability of a public proof-of-concept, the risk of localized disruption is elevated. Organizations utilizing GeoGebra Graphing Calculator should prioritize updating to the most recent version provided by the vendor. If an update is not immediately feasible, administrators should monitor for anomalous application behavior on systems where this software is deployed.

Description Summary:
GeoGebra Classic 5.0.631.0-d is susceptible to a denial of service vulnerability via an oversized input buffer, which can trigger an application crash.

Executive Summary:
A heap-based resource exhaustion vulnerability in GeoGebra Classic 5 allows a local attacker to crash the application, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2021-47876

Affected Software: GeoGebra Classic 5

Affected Versions: 5.0.631.0-d

Vulnerability: The application fails to properly throttle or limit resources during input processing, specifically within the "Entrada:" field. An attacker can supply a large buffer of 800,000 characters to trigger an application crash, requiring no authentication to exploit.

Business Impact

While the CVSS score is 7.5, the impact is primarily localized to the availability of the application on the affected workstation. Successful exploitation results in a denial of service, which can disrupt educational or professional workflows that rely on the software. While this does not lead to remote code execution or data theft, the forced termination of the software may result in the loss of unsaved work and temporary productivity impairment.

Remediation Plan

Immediate Action: Users should update to the latest available version of GeoGebra Classic to ensure all known resource management patches are applied.

Proactive Monitoring: IT administrators should monitor workstation event logs for recurring application crashes or unexpected terminations of the GeoGebra process.

Compensating Controls: As this is a local exploit, endpoint security policies should be enforced to restrict the execution of unauthorized scripts or tools that might be used to automate the delivery of the malicious buffer.

Exploitation Status

Public Exploit Available: Yes — a proof of concept exists via ExploitDB (EDB-ID: 49654).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently simple to trigger, as it only requires pasting a pre-generated string into the input field.

Analyst Recommendation

The vulnerability presents a clear risk to application availability on affected systems. Organizations utilizing GeoGebra Classic should prioritize updating to the most recent version provided by the vendor. If an immediate update is not feasible, users should be cautioned against pasting untrusted or unusually large blocks of text into the application input fields to avoid triggering the crash.

Description Summary:
GeoGebra CAS Calculator 6.0.631.0 is vulnerable to a denial of service flaw via a buffer overflow in the input field, allowing an attacker to crash the application.

Executive Summary:
A buffer overflow vulnerability in GeoGebra CAS Calculator 6.0.631.0 allows for application denial of service, posing a risk to local system stability.

Vulnerability Details

CVE-ID: CVE-2021-47875

Affected Software: GeoGebra CAS Calculator

Affected Versions: 6.0.631.0

Vulnerability: This vulnerability is caused by improper resource allocation, specifically a buffer overflow triggered when an excessively large string is pasted into the calculator input field. The flaw requires local access and can be triggered by an unauthenticated user interacting with the application interface.

Business Impact

Successful exploitation of this vulnerability results in an immediate application crash, causing a denial of service for the user. While the CVSS score is 9.8, the impact is primarily restricted to the local desktop environment, leading to potential workflow disruption and loss of unsaved data within the calculator application.

Remediation Plan

Immediate Action: Update the GeoGebra CAS Calculator to the latest available version provided by the vendor to ensure the buffer overflow flaw is resolved.

Proactive Monitoring: Security teams should monitor endpoint logs for recurring application crashes or unexpected process terminations involving the calculator executable.

Compensating Controls: As this is a local application, ensure endpoint security policies restrict the execution of unauthorized scripts or tools that might be used to automate the delivery of malformed input payloads.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit Database (EDB-ID: 49655).

Analyst Notes: As of January 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user with physical or remote access to the application interface by providing a specifically crafted string of 8000 repeated characters.

Analyst Recommendation

Given the availability of a functional proof-of-concept, the risk of exploitation is elevated for environments where this software is deployed. Administrators should prioritize updating the software to the latest version to prevent potential service disruption. If an update is not immediately feasible, users should be cautioned against pasting untrusted or excessively long text strings into the application input fields.

Description Summary:
VFS for Git 1.0.21014.1 contains an unquoted service path vulnerability in the GVFS.Service Windows service that allows local attackers to execute code with elevated privileges.

Executive Summary:
A critical unquoted service path vulnerability in VFS for Git allows local attackers to achieve arbitrary code execution with LocalSystem privileges.

Vulnerability Details

CVE-ID: CVE-2021-47874

Affected Software: VFS for Git

Affected Versions: 1.0.21014.1

Vulnerability: The GVFS.Service Windows service utilizes an unquoted file path, which allows a local attacker to place a malicious executable in the path hierarchy. This vulnerability requires local access to the system, where a low privileged user can trigger execution of the malicious binary with LocalSystem permissions during service startup or system reboot.

Business Impact

The exploitation of this vulnerability results in full system compromise, as code is executed with the highest level of Windows system privileges. This grants an attacker complete control over the affected machine, potentially leading to unauthorized data access, the installation of persistent backdoors, or lateral movement within the network. With a CVSS score of 7.8, the risk is classified as High, reflecting the significant impact on system integrity and availability.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified in the available documentation, administrators should restrict file system permissions on the affected directory to prevent unauthorized users from writing files to the path used by the GVFS.Service.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service restarts or new service creation events that may indicate an attempt to exploit the unquoted path.

Compensating Controls: Ensure that standard users do not have write access to the C:\Program Files directory or any subdirectories therein, effectively mitigating the ability to plant malicious binaries.

Exploitation Status

Public Exploit Available: Yes, a functional exploit is documented via ExploitDB (EDB-ID: 49661).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit for any user with local write access to the directory structure.

Analyst Recommendation

This vulnerability represents a significant security risk for any environment where VFS for Git is installed on Windows. Security teams must prioritize identifying systems running the vulnerable version and enforce strict directory access controls immediately. Given the availability of a public exploit, delaying remediation increases the window of opportunity for local attackers to escalate privileges to the LocalSystem level.

Description Summary:
VestaCP contains a stored cross-site scripting vulnerability in the IP interface configuration, allowing authenticated attackers to inject malicious scripts via the v_interface parameter.

Executive Summary:
An authenticated stored cross-site scripting vulnerability in VestaCP allows attackers to execute arbitrary scripts, posing a significant risk to administrative session integrity.

Vulnerability Details

CVE-ID: CVE-2021-47873

Affected Software: VestaCP VestaCP

Affected Versions: 0.9.8 through 0.9.8-25

Vulnerability: The application is susceptible to a stored cross-site scripting (XSS) attack via the v_interface parameter. An authenticated user with sufficient privileges to access the IP configuration can inject a malicious script into the application, which is then stored and executed in the context of other users, including administrators, when they view the affected interface.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a victim, which can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive session cookies. Given the administrative nature of the VestaCP interface, this could result in a full compromise of the hosting control panel environment. The CVSS score of 7.2 reflects the high potential for impact on confidentiality and integrity despite requiring authenticated access.

Remediation Plan

Immediate Action: Update VestaCP to version 0.9.8-26 or later to incorporate the vendor-supplied security patches.

Proactive Monitoring: Review access logs for suspicious POST requests directed at the /add/ip/ endpoint, particularly those containing script tags or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious payloads containing script tags within HTTP POST parameters to provide temporary protection.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49662.

Analyst Notes: As of January 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any authenticated user who has the permissions to modify IP interface configurations.

Analyst Recommendation

This vulnerability presents a clear risk to administrative and user sessions within the VestaCP control panel. Administrators should treat this issue with high urgency, prioritizing the application of the vendor patch to ensure the security of the management interface. Organizations unable to patch immediately must implement strict access controls for administrative functions and utilize WAF filtering to mitigate the risk of script injection.

Description Summary:
Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability in the API index.php endpoint, allowing authenticated attackers to write files to arbitrary locations.

Executive Summary:
An arbitrary file write vulnerability in Hestia Control Panel 1.3.2 allows authenticated attackers to execute unauthorized file operations, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47871

Affected Software: Hestia Control Panel

Affected Versions: 1.3.2 and below

Vulnerability: The application is susceptible to an arbitrary file write vulnerability via the API index.php endpoint. By leveraging the v-make-tmp-file command, an authenticated attacker can write files to sensitive locations, such as adding unauthorized SSH keys to the server.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to gain full control over the affected server. By writing arbitrary content to critical file paths, such as SSH authorized_keys, an attacker can establish persistent backdoor access, resulting in complete system compromise and potential data exfiltration. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat that requires immediate attention to prevent unauthorized administrative access.

Remediation Plan

Immediate Action: Upgrade Hestia Control Panel to version 1.3.3 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review system logs for suspicious API requests to index.php, particularly those invoking the v-make-tmp-file command with unusual file paths.

Compensating Controls: Restrict access to the API endpoint to trusted IP addresses using a Web Application Firewall or network-level access control lists to limit the exposure of the management interface.

Exploitation Status

Public Exploit Available: Yes, a public exploit exists as documented in the Exploit Database (EDB-ID: 49667).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct nature of the API command, which requires only valid authentication to execute.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of the Hestia Control Panel environment. Administrators should prioritize updating the software to version 1.3.3 or higher to close the file write vector. Failure to patch may allow attackers to escalate privileges or establish persistence, leading to a complete system takeover.

Description Summary:
Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRA_Scheduler service, allowing local privilege escalation to SYSTEM.

Executive Summary:
An unquoted service path vulnerability in Brother BRAdmin Professional 3.75 allows local attackers to escalate privileges to SYSTEM level.

Vulnerability Details

CVE-ID: CVE-2021-47869

Affected Software: Brother BRAdmin Professional

Affected Versions: 3.75.0000

Vulnerability: The application utilizes an unquoted service path for the BRA_Scheduler service, which executes with LocalSystem privileges. A local attacker with write access to the directory containing the service binary can place a malicious executable to hijack the service execution flow.

Business Impact

Successful exploitation allows an unprivileged local user to gain full administrative control over the affected Windows host. This facilitates complete system compromise, including data exfiltration, persistence, and lateral movement within the network. The CVSS score of 7.8 reflects a High severity impact, as it provides a direct path for privilege escalation on managed workstations or servers.

Remediation Plan

Immediate Action: Update to the latest version of BRAdmin Professional if a patched version is available, or ensure the service path is correctly quoted in the Windows Registry to prevent execution hijacking.

Proactive Monitoring: Review Windows System Event Logs for unexpected service installations or unauthorized modifications to the C:\Program Files (x86)\Brother\ directory.

Compensating Controls: Restrict file system permissions on the installation directory to prevent non-administrative users from writing or modifying files within the Brother application folders.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the Exploit-DB entry (EDB-ID: 49671).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is a classic unquoted service path flaw, which is inherently easy to exploit if directory permissions are misconfigured.

Analyst Recommendation

This vulnerability presents a significant risk to internal security by providing a trivial path to full administrative access. Security teams should prioritize identifying all instances of BRAdmin Professional 3.75 and applying vendor-supplied updates or manual path remediation in the registry to neutralize this privilege escalation vector immediately.

Description Summary:
Honeywell WIN-PAK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to execute code with elevated system privileges.

Executive Summary:
A local privilege escalation vulnerability in Honeywell WIN-PAK PRO 4.8 allows authenticated attackers to execute arbitrary code with LocalSystem permissions.

Vulnerability Details

CVE-ID: CVE-2021-47868

Affected Software: Honeywell WIN-PAK PRO

Affected Versions: 4.8

Vulnerability: This vulnerability involves an unquoted service path in the WPCommandFileService, specifically located at C:\Program Files \WINPAKPRO\WPCommandFileService Service.exe. By placing a malicious executable in a specific directory along this path, a local user can trigger the execution of their code with LocalSystem privileges during the service startup process.

Business Impact

Successful exploitation of this flaw leads to a complete compromise of the host system, as the attacker gains LocalSystem privileges. This level of access allows an attacker to bypass standard security controls, install persistent backdoors, or access sensitive data managed by the software. Given the CVSS score of 7.8, this represents a high-risk security gap that could lead to significant operational disruption if the underlying host is compromised.

Remediation Plan

Immediate Action: Contact Honeywell support to obtain the official security update or configuration guidance to secure the service path. Ensure that the service configuration is updated to use a quoted path or move the executable to a secure directory.

Proactive Monitoring: Audit Windows services for unquoted service paths and monitor system logs for unusual process creation events originating from the WIN-PAK installation directory.

Compensating Controls: Restrict write permissions on the C:\Program Files (x86) directory to prevent unauthorized users from placing malicious executables in potential search paths.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 49692).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly reliable because it exploits standard Windows service behavior regarding path resolution.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity of systems running Honeywell WIN-PAK PRO 4.8. Administrators should prioritize the remediation of this unquoted service path through vendor-provided patches or manual configuration changes. Given the availability of a public proof-of-concept, the urgency for remediation is elevated, and organizations should ensure that local user permissions are strictly managed to prevent the placement of malicious binaries.

Description Summary:
WIN-PAK 4.8 contains an unquoted service path vulnerability in the ScheduleService that allows local users to execute code with elevated system privileges.

Executive Summary:
A local privilege escalation vulnerability in Honeywell WIN-PAK 4.8 allows authenticated local users to execute arbitrary code with system-level privileges.

Vulnerability Details

CVE-ID: CVE-2021-47867

Affected Software: Honeywell WIN-PAK

Affected Versions: 4.8

Vulnerability: The application suffers from an unquoted service path vulnerability (CWE-428) within the ScheduleService. Because the service path contains spaces and lacks quotes, a local attacker can place a malicious executable in the path hierarchy, which the system will then execute with elevated privileges upon service startup.

Business Impact

Successful exploitation of this vulnerability allows a local attacker to gain full control over the affected system. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to the latest version of WIN-PAK provided by Honeywell that addresses this security flaw. If an immediate update is not feasible, administrators should manually quote the service path in the Windows Registry to prevent the execution of unauthorized binaries.

Proactive Monitoring: Monitor Windows System event logs for unusual service startup activities or the creation of unexpected executable files within the C:\Program Files\ directory structure.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent non-privileged users from creating or modifying files within the application path.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 49691).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user with sufficient permissions to write files to the system drive root or the application directory.

Analyst Recommendation

This vulnerability presents a significant risk to system integrity due to the potential for privilege escalation. Organizations running WIN-PAK 4.8 must prioritize patching this service path configuration immediately to prevent unauthorized users from gaining administrative control over the host.

Description Summary:
Honeywell WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to execute code with elevated system privileges.

Executive Summary:
A local privilege escalation vulnerability in Honeywell WIN-PACK PRO 4.8 allows authenticated local users to execute arbitrary code with system-level privileges.

Vulnerability Details

CVE-ID: CVE-2021-47866

Affected Software: Honeywell WIN-PACK PRO

Affected Versions: 4.8

Vulnerability: The application utilizes an unquoted service path for the GuardTourService, which enables a local user to inject a malicious executable into the path, leading to code execution upon service restart with elevated LocalSystem privileges.

Business Impact

Successful exploitation of this flaw allows a local user to gain full administrative control over the underlying Windows host. This effectively bypasses standard security boundaries, potentially leading to total system compromise, data theft, and the installation of persistent malicious software. Given the CVSS score of 7.8, this represents a high-severity risk for any environment where untrusted local users have access to the server.

Remediation Plan

Immediate Action: Contact Honeywell support to obtain the latest security patches or configuration guidance to resolve the unquoted service path issue, as no public patch version is currently listed.

Proactive Monitoring: Monitor Windows System Event Logs for unexpected service restarts or new file creation events within the C:\Program Files (x86)\ directory.

Compensating Controls: Ensure that local users are restricted from writing to the C:\Program Files (x86)\ directory and that the service permissions are hardened to prevent modification by unauthorized users.

Exploitation Status

Public Exploit Available: Yes, a technical write-up and proof-of-concept are available via ExploitDB (EDB-ID 49690).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it relies on standard Windows behavior regarding how the operating system handles unquoted service paths.

Analyst Recommendation

The presence of a published proof-of-concept significantly elevates the risk of this vulnerability. Administrators must prioritize securing the service path or restricting directory access immediately to prevent local attackers from escalating their privileges to the system level. If an official patch is not yet applied, strictly enforce the principle of least privilege for all local user accounts on the affected host.

Description Summary:
ProFTPD 1.3.7a is vulnerable to a denial of service attack where unauthenticated users can exhaust server connection limits by establishing multiple simultaneous FTP connections.

Executive Summary:
ProFTPD 1.3.7a contains a critical resource exhaustion vulnerability that allows unauthenticated remote attackers to render the service unavailable to legitimate users.

Vulnerability Details

CVE-ID: CVE-2021-47865

Affected Software: ProFTPD ProFTPD

Affected Versions: 1.3.7a

Vulnerability: This is a resource management flaw (CWE-770) where the application fails to adequately throttle or limit simultaneous FTP connections. An unauthenticated attacker can leverage this to exhaust server resources, effectively blocking all other users from accessing the service.

Business Impact

Successful exploitation of this vulnerability results in a complete denial of service for the FTP server, leading to significant operational disruption. Because the vulnerability is remotely exploitable without authentication and carries a CVSS score of 7.5, it poses a high risk to business continuity, particularly for organizations relying on ProFTPD for critical file transfer workflows.

Remediation Plan

Immediate Action: Review the official ProFTPD documentation and security advisories to determine if a patch is available for your specific deployment, or consider upgrading to a more recent, supported version of ProFTPD.

Proactive Monitoring: Monitor server logs and connection metrics for an unusual spike in concurrent connection attempts from single or multiple IP addresses, which may indicate an ongoing denial of service attempt.

Compensating Controls: Implement connection limiting features within the ProFTPD configuration, such as the MaxClients or MaxConnectionsPerHost directives, and utilize rate-limiting rules on external firewalls or load balancers to mitigate the impact of connection floods.

Exploitation Status

Public Exploit Available: Yes — a functional Python-based denial of service script is available via ExploitDB (EDB-ID 49697).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to exploit using common threading techniques or basic script automation.

Analyst Recommendation

Given the availability of a public exploit and the ease of triggering this denial of service condition, administrators should prioritize hardening their ProFTPD configurations immediately. Even in the absence of a direct software patch, enforcing strict connection limits is a necessary step to maintain service availability and prevent unauthorized resource exhaustion.

Description Summary:
OSAS Traverse Extension 11 contains an unquoted service path vulnerability in the TravExtensionHostSvc service, allowing potential local privilege escalation to LocalSystem.

Executive Summary:
An unquoted service path vulnerability in the OSAS Traverse Extension 11 service allows a local attacker to execute arbitrary code with LocalSystem privileges.

Vulnerability Details

CVE-ID: CVE-2021-47864

Affected Software: OSAS Traverse Extension

Affected Versions: 11 x86

Vulnerability: The TravExtensionHostSvc service utilizes an unquoted executable path, which is a classic flaw where the Windows Service Control Manager may interpret path segments as independent executable files. Because the service runs with LocalSystem privileges, an attacker with local access can place a malicious binary in a higher-level directory to achieve full system compromise.

Business Impact

The exploitation of this vulnerability results in full administrative control over the underlying host. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and the potential for lateral movement within the production environment.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should manually modify the service path in the Windows Registry to wrap the binary location in double quotes (e.g., "C:\Program Files\Open Systems, Inc\TRAVERSE\TRAVERSE.Host.CustomExtensions.exe").

Proactive Monitoring: Audit Windows service configurations for unquoted paths using tools such as WMIC or PowerShell, and monitor system logs for unusual process execution patterns originating from the service directory.

Compensating Controls: Restrict local user permissions on the server to prevent unauthorized file creation in directories contained within the service path, effectively neutralizing the attack vector.

Exploitation Status

Public Exploit Available: Yes, a functional local exploit is documented on ExploitDB (EDB-ID: 49698).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit for any user with local write access to the affected directory.

Analyst Recommendation

While this vulnerability requires local access, the resulting impact is total system compromise. Organizations running OSAS Traverse Extension 11 must prioritize the manual remediation of the service path configuration immediately, as the existence of a public exploit significantly lowers the barrier to entry for potential attackers.

Description Summary:
MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability in its service configuration, potentially allowing local attackers to execute arbitrary code and escalate privileges on Windows.

Executive Summary:
A local privilege escalation vulnerability in MacPaw Encrypto 1.0.1 allows attackers to execute arbitrary code by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47863

Affected Software: MacPaw Encrypto

Affected Versions: 1.0.1

Vulnerability: The application utilizes an unquoted service path for the Encrypto Service, which is a common misconfiguration that allows a local user to place a malicious executable in the parent directory of the path. When the service restarts, the system executes the malicious file with LocalSystem privileges instead of the intended binary.

Business Impact

Successful exploitation of this vulnerability leads to a full compromise of the affected Windows host. Because the service runs with LocalSystem privileges, an attacker can gain complete control over the operating system, bypass security controls, and access sensitive data. Given the CVSS score of 7.8, this represents a high-severity risk to business operations and data integrity.

Remediation Plan

Immediate Action: Since no official patch is currently identified for this legacy version, administrators should restrict filesystem permissions on the installation directory to prevent unauthorized users from writing files to the path.

Proactive Monitoring: Monitor system logs for the creation of new, unexpected executable files within the C:\Program Files\ directory and review service startup events for anomalous behavior.

Compensating Controls: Implement endpoint security solutions that detect and block unauthorized modification of service binary paths or the execution of unsigned binaries in protected system directories.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exploit is available via the Exploit Database (EDB-ID: 49694).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user who can write to the filesystem, making it a significant risk in multi-user or shared environments.

Analyst Recommendation

The presence of a publicly available exploit for this unquoted service path vulnerability necessitates immediate attention. Organizations should prioritize restricting folder permissions to prevent unauthorized file placement and evaluate the necessity of the software if a vendor-provided update remains unavailable. Failure to secure the service path allows for trivial privilege escalation, which could facilitate broader lateral movement within the network.

Description Summary:
Hi-Rez Studios HiPatchService 5.1.6.3 is vulnerable to an unquoted service path flaw, allowing local attackers to execute arbitrary code with elevated privileges during system startup.

Executive Summary:
A high-severity unquoted service path vulnerability in the Hi-Rez Studios HiPatchService allows local attackers to achieve arbitrary code execution with LocalSystem privileges.

Vulnerability Details

CVE-ID: CVE-2021-47862

Affected Software: Hi-Rez Studios HiPatchService

Affected Versions: 5.1.6.3

Vulnerability: The application is susceptible to an unquoted search path vulnerability (CWE-428) where the service binary path contains spaces and is not enclosed in quotes. A local attacker with low privileges can place a malicious executable in the path to hijack the service execution upon system reboot or service restart.

Business Impact

Successful exploitation grants an attacker full control over the affected system with LocalSystem privileges. This bypasses standard user access controls, potentially leading to total system compromise, data exfiltration, or the deployment of persistent malware. With a CVSS score of 7.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of any host running the affected software.

Remediation Plan

Immediate Action: Update the HiPatchService to the latest available version provided by Hi-Rez Studios that resolves the service path configuration. If an update is unavailable, administrators should manually update the service registry path to enclose the executable path in quotes.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or the creation of unexpected executables within the "C:\Program Files (x86)\Hi-Rez Studios" directory.

Compensating Controls: Restrict write permissions on the directory containing the service executable to prevent unauthorized users from placing malicious files in the search path.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID 49701).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because Windows service control managers prioritize unquoted paths during service initialization.

Analyst Recommendation

Given the potential for full system compromise via privilege escalation, immediate remediation is required. Administrators should prioritize patching the HiPatchService or applying the manual registry fix to ensure the service path is properly quoted and secured against path hijacking.

Description Summary:
Event Log Explorer 4.9.3 contains an unquoted service path vulnerability allowing local users to execute arbitrary code with elevated system privileges.

Executive Summary:
A vulnerability in FSPro Labs Event Log Explorer 4.9.3 allows local attackers to gain elevated system privileges by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47861

Affected Software: FSPro Labs Event Log Explorer

Affected Versions: 4.9.3

Vulnerability: The application utilizes an unquoted service path for the ElodeaEventCollectorService, which permits a local user to place a malicious executable in a directory that the service incorrectly interprets as a path component. This allows the attacker to execute arbitrary code under the context of the LocalSystem account during service startup.

Business Impact

Successful exploitation of this flaw grants an attacker full control over the affected system by elevating local access to administrative privileges. This poses a severe risk to data confidentiality, integrity, and availability, as the attacker can install malware, access sensitive event logs, or pivot further into the internal network. The CVSS score of 7.8 reflects the high severity of this local privilege escalation vector.

Remediation Plan

Immediate Action: Update to the latest version of Event Log Explorer provided by FSPro Labs, which addresses the unquoted service path issue. If an update is not immediately available, administrators should manually modify the service path registry key to include quotes around the executable path.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service startup failures or the creation of new executable files in the Program Files directory. Review system logs for unauthorized changes to service configurations or registry keys related to service paths.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent unauthorized users from writing files to the application path. Ensure that the principle of least privilege is enforced for all local user accounts to limit the impact of potential local exploitation.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented on Exploit-DB.

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from standard Windows service path parsing behavior when paths containing spaces are not enclosed in quotation marks.

Analyst Recommendation

This vulnerability represents a significant security risk for any host running the affected version of the Event Log Explorer. Administrators must prioritize updating the software or manually correcting the service path configuration to prevent local attackers from achieving full system compromise.

Description Summary:
ActivIdentity 8.2 is vulnerable to an unquoted service path flaw in the ac.sharedstore service, which allows local attackers to execute arbitrary code and escalate system privileges.

Executive Summary:
A local privilege escalation vulnerability in HID Global ActivIdentity 8.2 allows attackers to gain system-level access by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47859

Affected Software: HID Global ActivIdentity

Affected Versions: 8.2

Vulnerability: The software contains an unquoted service path vulnerability in the ac.sharedstore service. This flaw allows a local, authenticated attacker to place a malicious executable in a parent directory of the service path, which the service will then execute with elevated privileges.

Business Impact

The ability for a local user to escalate privileges to LocalSystem status poses a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized access to sensitive credential data handled by the smart card software, and the potential for lateral movement within the network. The CVSS score of 7.8 reflects the high severity of this local access vulnerability.

Remediation Plan

Immediate Action: Upgrade to a version of ActivIdentity that resolves this service path configuration issue, or contact HID Global support if a patch is not directly available for your specific deployment.

Proactive Monitoring: Review system logs for unauthorized file creation attempts within the C:\Program Files\Common Files\ActivIdentity directory.

Compensating Controls: Ensure that standard users are restricted from writing to the directory path C:\Program Files\Common Files\ActivIdentity, as this will prevent the placement of malicious binaries required to trigger the exploit.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit-DB entry 49703.

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the service path contains spaces and lacks protective quotes, causing the Windows service control manager to misinterpret the path.

Analyst Recommendation

Given the availability of a proof-of-concept exploit, this vulnerability should be prioritized for remediation in all environments where ActivIdentity 8.2 is deployed. Administrators must ensure that directory permissions are strictly enforced as an immediate temporary measure while working toward a permanent software update.

Description Summary:
The Genexis Platinum-4410 firmware contains a stored cross-site scripting (XSS) vulnerability in the Security Management interface that allows attackers to inject persistent malicious scripts.

Executive Summary:
A stored cross-site scripting vulnerability in the Genexis Platinum-4410 firmware allows authenticated attackers to execute arbitrary scripts in the context of other privileged users.

Vulnerability Details

CVE-ID: CVE-2021-47858

Affected Software: Genexis Platinum-4410

Affected Versions: Firmware 1.31A

Vulnerability: This is a stored cross-site scripting (CWE-79) vulnerability located in the start_addr parameter of the Security Management interface. An authenticated attacker can inject malicious JavaScript that will execute whenever a privileged user accesses the affected security management page.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code within the browser session of an administrative user. This can lead to unauthorized configuration changes, session hijacking, or the theft of sensitive administrative credentials. Given the CVSS score of 7.2, this represents a high-severity risk that could compromise the integrity and security of the device management interface.

Remediation Plan

Immediate Action: Consult the official Genexis support portal to determine if a firmware update is available for your specific unit to resolve this cross-site scripting flaw.

Proactive Monitoring: Review web access logs for the security management interface to detect unusual request patterns or attempts to inject script-like characters into input fields.

Compensating Controls: If a patch is unavailable, restrict access to the device management interface to trusted internal IP addresses only, and educate administrative users on the risks of clicking suspicious links or interacting with untrusted management console content.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the ExploitDB entry 49709.

Analyst Notes: As of January 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any authenticated user with access to the security management configuration settings.

Analyst Recommendation

This vulnerability presents a significant risk to the administrative integrity of the Genexis Platinum-4410 series. Security teams should prioritize identifying affected firmware versions and applying vendor-supplied patches as soon as they are made available to prevent potential account takeovers or unauthorized administrative actions.

Description Summary:
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field, allowing attackers to inject and execute arbitrary malicious scripts.

Executive Summary:
A persistent cross-site scripting vulnerability in Moodle 3.10.3 allows authenticated attackers to execute arbitrary JavaScript, potentially leading to session hijacking or unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2021-47857

Affected Software: Moodle Moodle

Affected Versions: Moodle 3.10.3

Vulnerability: This is a persistent cross-site scripting (XSS) flaw (CWE-79) triggered via the calendar event subtitle field. An authenticated user can inject malicious scripts into the subtitle track label, which executes when other users view the event.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of a victim's browser session. This could lead to the theft of session cookies, unauthorized access to user accounts, or the redirection of users to malicious websites, resulting in significant data compromise and reputational harm. The CVSS score of 7.2 reflects the high potential for impact within a collaborative learning environment.

Remediation Plan

Immediate Action: Upgrade Moodle to a secure, supported version that resolves this vulnerability. If an immediate upgrade is not feasible, restrict the ability of users to create calendar events or use media features.

Proactive Monitoring: Review application logs for unusual activity related to the core_calendar_submit_create_update_form endpoint. Monitor for injected script tags within calendar event metadata or unexpected user session behavior.

Compensating Controls: Implement a robust Web Application Firewall (WAF) configured to detect and block XSS patterns in POST requests. Ensure that Content Security Policy (CSP) headers are strictly enforced to limit the execution of unauthorized scripts.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the Exploit-DB entry (EDB-ID 49714).

Analyst Notes: As of January 22, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exploit exists, making the risk of exploitation credible. The vulnerability is inherently easy to trigger by any user with permission to create calendar events.

Analyst Recommendation

Given the availability of a public proof-of-concept and the nature of persistent XSS, this vulnerability poses a clear risk to the integrity of user sessions within the Moodle platform. Security teams should prioritize patching affected installations to the latest vendor-recommended version to prevent potential account takeovers and unauthorized activity.

Description Summary:
OpenLiteSpeed 1.7.9 is vulnerable to stored cross-site scripting (XSS) in the dashboard Notes parameter, allowing authenticated administrators to inject and execute malicious scripts.

Executive Summary:
An authenticated stored cross-site scripting vulnerability in OpenLiteSpeed 1.7.9 could allow an attacker with administrative access to execute arbitrary scripts in the context of the web dashboard.

Vulnerability Details

CVE-ID: CVE-2021-47855

Affected Software: LiteSpeed Technologies OpenLiteSpeed

Affected Versions: 1.7.9

Vulnerability: This is a stored cross-site scripting (CWE-79) vulnerability occurring within the Notes parameter of the listener configuration. An authenticated administrator can inject malicious JavaScript that executes when another user or administrator interacts with the Default Icon in the management interface.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code within the victim's browser session, potentially leading to session hijacking, unauthorized administrative actions, or the further compromise of the web server configuration. With a CVSS score of 7.2, this vulnerability represents a significant risk to the integrity and confidentiality of the administrative interface, which is a critical component for server management.

Remediation Plan

Immediate Action: Upgrade OpenLiteSpeed to a version beyond 1.7.9 that contains the necessary input sanitization fixes.

Proactive Monitoring: Review web server access logs for unusual POST requests directed at the /view/confMgr.php endpoint or anomalies in administrative dashboard activity.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious script payloads from being submitted to administrative configuration fields.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49727.

Analyst Notes: As of January 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user with existing administrative privileges who can access the listener configuration menu.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high-privilege context of the vulnerability, administrators should prioritize updating their OpenLiteSpeed installations. While this requires administrative access to trigger, the potential for lateral movement or persistence within the management console necessitates immediate remediation to secure the server environment.

Description Summary:
A buffer overflow vulnerability in the UPNP network discovery service of DD-WRT version 45723 allows unauthenticated remote attackers to execute arbitrary code via crafted M-SEARCH packets.

Executive Summary:
A critical buffer overflow vulnerability in the DD-WRT UPNP service permits unauthenticated remote code execution, posing a severe risk to network device integrity.

Vulnerability Details

CVE-ID: CVE-2021-47854

Affected Software: embeDD GmbH DD-WRT

Affected Versions: 45723 and prior

Vulnerability: The flaw exists within the UPNP network discovery service, where the application fails to perform adequate bounds checking on incoming data. An unauthenticated attacker can send a specially crafted M-SEARCH packet containing an oversized UUID payload to trigger a buffer overflow condition, potentially leading to arbitrary code execution.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its critical nature and ease of exploitation. Successful exploitation allows an attacker to gain full control over the affected network device, potentially leading to unauthorized network access, interception of traffic, or the deployment of persistent malware within the infrastructure. This poses a significant risk to organizational confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update all instances of DD-WRT to the latest available firmware version provided by the vendor to patch the buffer overflow vulnerability.

Proactive Monitoring: Monitor network traffic for unusual M-SEARCH packets or unexpected spikes in traffic directed toward port 1900, which is commonly used for UPNP discovery.

Compensating Controls: Disable the UPNP service on all affected devices if it is not strictly required for business operations, as this effectively eliminates the attack vector.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in Exploit-DB (EDB-ID: 49730).

Analyst Notes: As of January 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of the UPNP service, which is often exposed to the network, allowing remote attackers to trigger the overflow without prior authentication.

Analyst Recommendation

Given the critical CVSS severity and the availability of public proof-of-concept code, immediate action is required to secure vulnerable environments. Administrators should verify their current firmware version and apply the vendor-provided security patches immediately. If patching is not feasible, disabling the UPNP service is the most effective temporary mitigation to prevent potential remote exploitation.

Description Summary:
phpPgAdmin 7 contains an unspecified vulnerability that requires further investigation. The nature of the flaw and its specific impact remain insufficiently documented in available records.

Executive Summary:
A high-severity vulnerability in phpPgAdmin 7 presents a significant security risk, requiring immediate investigation and remediation as soon as vendor guidance is published.

Vulnerability Details

CVE-ID: CVE-2021-47853

Affected Software: phpPgAdmin phpPgAdmin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an unspecified vulnerability affecting phpPgAdmin 7. Due to a lack of detailed technical documentation, the precise entry point and required authentication level for exploitation remain unconfirmed.

Business Impact

The CVSS score of 8.8 indicates a high-severity risk that could lead to unauthorized system access or data compromise if exploited. Organizations relying on this software for database administration face potential operational disruption and the loss of sensitive information, necessitating a proactive approach to security patching.

Remediation Plan

Immediate Action: Monitor official phpPgAdmin channels for the release of security patches and apply updates immediately upon availability.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as unauthorized administrative attempts or suspicious query strings.

Compensating Controls: Implement strict network access controls to restrict access to the phpPgAdmin interface to authorized administrative IP addresses only, and deploy a Web Application Firewall to block common web-based attack vectors.

Exploitation Status

Public Exploit Available: No confirmed public exploit has been identified in the available data.

Analyst Notes: As of January 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of specific technical details regarding the flaw suggests that further research is required to fully understand the attack surface.

Analyst Recommendation

Given the high CVSS score, this vulnerability should be treated as a priority for the security team. Administrators are advised to maintain heightened vigilance and ensure that all instances of phpPgAdmin are isolated from public exposure until a vendor-supplied patch is successfully deployed.

Description Summary:
Rockstar Games Launcher 1.0.37.349 contains a privilege escalation vulnerability due to weak file permissions on the service executable, allowing authenticated users to gain elevated system access.

Executive Summary:
A privilege escalation vulnerability in the Rockstar Games Launcher allows local authenticated users to execute arbitrary code with system privileges, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47852

Affected Software: Rockstar Games Rockstar Games Launcher

Affected Versions: 1.0.37.349

Vulnerability: The application suffers from an incorrect default permissions issue (CWE-276) where the RockstarService.exe binary is writable by the Authenticated Users group. An attacker with standard local user access can replace this executable with a malicious binary to achieve arbitrary code execution as a local administrator.

Business Impact

Successful exploitation grants an attacker full control over the local system, enabling the installation of malware, theft of sensitive credentials, or further lateral movement within the network. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could lead to significant operational disruption and data breach if an attacker gains a foothold on a machine running the affected launcher.

Remediation Plan

Immediate Action: Update the Rockstar Games Launcher to the latest version provided by the vendor to remediate the insecure file permissions.

Proactive Monitoring: Review local system logs for unexpected service restarts or modifications to binaries within the installation directory of the Rockstar Games Launcher.

Compensating Controls: Restrict local user permissions to prevent non-administrative users from modifying files within application directories, and employ Endpoint Detection and Response (EDR) solutions to flag unauthorized binary replacement attempts.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists in the Exploit Database (EDB-ID 49739).

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable by any local user, as it requires only standard permissions to replace the service executable and trigger the escalation.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the high-severity nature of local privilege escalation, organizations should prioritize updating all instances of the Rockstar Games Launcher. Administrators must ensure that the service executable is protected by appropriate access control lists to prevent unauthorized modification, and immediately patch the software to eliminate the underlying permission flaw.

Description Summary:
Mini Mouse 9.2.0 contains an unauthenticated OS command injection vulnerability in the /op=command endpoint, allowing remote attackers to execute arbitrary commands via crafted JSON requests.

Executive Summary:
Mini Mouse 9.2.0 is vulnerable to unauthenticated remote code execution, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47851

Affected Software: Yodinfo Mini Mouse

Affected Versions: 9.2.0

Vulnerability: This is an OS command injection vulnerability (CWE-78) occurring within the /op=command HTTP endpoint. An unauthenticated attacker can send a specially crafted JSON payload to this endpoint to download and execute arbitrary scripts or binaries on the underlying host.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve full remote code execution on the affected host. This provides the attacker with complete control over the system, potentially leading to unauthorized data exfiltration, lateral movement within the network, and complete service disruption. Given the CVSS score of 9.8, this vulnerability represents a critical risk to business continuity and information security.

Remediation Plan

Immediate Action: Disconnect affected instances from public networks immediately and restrict access to the /op=command endpoint via network-level controls. Verify if a newer version is available from the vendor and apply it as the primary mitigation.

Proactive Monitoring: Review web server and system access logs for incoming POST requests to the /op=command endpoint originating from untrusted or unexpected IP addresses. Monitor for suspicious child processes spawning from the Mini Mouse application, such as certutil.exe or cmd.exe.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to drop all incoming traffic directed at the /op=command path. If a WAF is unavailable, ensure the application is placed behind a robust authentication proxy to prevent unauthenticated access.

Exploitation Status

Public Exploit Available: Yes, a functional exploit script is available via ExploitDB (EDB-ID 49743).

Analyst Notes: As of January 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to exploit as it requires no authentication and utilizes standard system tools to execute malicious payloads.

Analyst Recommendation

This vulnerability is highly severe and requires immediate attention due to the ease of exploitation and the potential for total system compromise. Organizations must prioritize restricting network access to the vulnerable endpoint while seeking and applying vendor-provided patches. Failure to remediate this flaw leaves the infrastructure exposed to trivial, unauthenticated remote code execution attacks.

Description Summary:
Mini Mouse 9.2.0 is vulnerable to path traversal, allowing unauthenticated remote attackers to access and list arbitrary files and directories on the host system via crafted HTTP requests.

Executive Summary:
A path traversal vulnerability in Yodinfo Mini Mouse 9.2.0 allows unauthenticated attackers to perform unauthorized file system access, posing a severe risk to system confidentiality.

Vulnerability Details

CVE-ID: CVE-2021-47850

Affected Software: Yodinfo Mini Mouse

Affected Versions: 9.2.0

Vulnerability: The application is susceptible to a path traversal flaw (CWE-22) in its file handling logic. An unauthenticated attacker can exploit this by sending malicious HTTP GET or POST requests to the web interface, allowing them to bypass directory restrictions and retrieve sensitive system files or enumerate contents of arbitrary directories.

Business Impact

Successful exploitation of this vulnerability grants an attacker unauthorized access to the underlying file system of the host machine. This could lead to the exposure of sensitive configuration files, user data, or system credentials, potentially facilitating further compromise or lateral movement within the network. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to data integrity and organizational security.

Remediation Plan

Immediate Action: As no official patch is currently identified, users should restrict network access to the Mini Mouse web interface by placing it behind a VPN or firewall, ensuring it is not exposed to the public internet.

Proactive Monitoring: Security teams should audit web server access logs for anomalous requests containing path traversal patterns, such as ".." sequences, or unexpected calls to the "get_file_list" function.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block directory traversal attempts and filter requests containing suspicious path parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exploit exists, as detailed in the Exploit-DB entry 49744.

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication.

Analyst Recommendation

The presence of a functional proof-of-concept exploit makes this vulnerability a credible threat that requires immediate attention. Organizations currently utilizing Mini Mouse 9.2.0 must prioritize isolating the application from external access until a vendor-supplied security update becomes available to resolve the underlying path traversal mechanism.

Description Summary:
Blitar Tourism 1.0 contains an SQL injection vulnerability in the username parameter that allows unauthenticated attackers to bypass authentication and gain unauthorized administrative access.

Executive Summary:
An authentication bypass vulnerability in Blitar Tourism 1.0 allows unauthenticated attackers to hijack administrative sessions via SQL injection.

Vulnerability Details

CVE-ID: CVE-2021-47848

Affected Software: Blitar Tourism

Affected Versions: 1.0

Vulnerability: This vulnerability is a classic SQL injection (CWE-89) located in the login mechanism. An unauthenticated attacker can submit a crafted username string to the /travel/Admin/ endpoint to manipulate backend database queries, effectively bypassing the authentication gate without a valid password.

Business Impact

Successful exploitation grants an attacker full administrative control over the application. This level of access poses a severe risk to data integrity and confidentiality, as an attacker could modify travel records, access sensitive user information, or conduct further malicious activities within the environment. Given the CVSS score of 8.2, this vulnerability represents a high-severity risk that requires immediate attention to prevent unauthorized system compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the administrative login portal and consider disabling the application until a secure version is released.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests to the /travel/Admin/ endpoint, specifically looking for characters indicative of SQL injection such as single quotes and hash symbols.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in the username field to mitigate the risk of exploitation.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the Exploit-DB entry 49759.

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible, as it requires no prior authentication and targets a common administrative login endpoint.

Analyst Recommendation

The severity of this flaw, combined with the availability of a public exploit, necessitates immediate defensive action. Organizations utilizing Blitar Tourism 1.0 must prioritize the implementation of compensating controls or restrict access to the application to prevent unauthorized administrative entry. Monitoring for evidence of exploitation is essential until a formal vendor-supplied patch can be applied.

Description Summary:
Disk Sorter Server 13.6.12 is vulnerable to an unquoted service path flaw, which could allow a local attacker to execute arbitrary code or escalate privileges.

Executive Summary:
A local unquoted service path vulnerability in Disk Sorter Server 13.6.12 enables attackers to achieve unauthorized privilege escalation and arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2021-47847

Affected Software: Sorter Disk Sorter Server

Affected Versions: 13.6.12

Vulnerability: The application utilizes an unquoted service path for the binary at C:\Program Files\Disk Sorter Server\bin\disksrs.exe. This misconfiguration allows a local user with sufficient filesystem permissions to place a malicious executable in the path, which the service will then execute with LocalSystem privileges.

Business Impact

The exploitation of this vulnerability results in full system compromise, as it allows a low-privileged local user to escalate their permissions to LocalSystem. With a CVSS score of 7.8, this represents a significant risk to the integrity and availability of the affected server, potentially leading to unauthorized data access, the installation of persistent backdoors, or complete system takeover.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should manually modify the service path configuration in the Windows Registry to wrap the binary path in double quotes.

Proactive Monitoring: Review system logs for unexpected service restarts or the creation of unauthorized executable files within the C:\Program Files\Disk Sorter Server\ directory.

Compensating Controls: Implement strict filesystem permissions on the installation directory to prevent non-administrative users from writing or modifying files within the application path.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 50013).

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit for any user with local write access to the affected folder.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high potential for privilege escalation, administrators must prioritize securing the service path. While waiting for a formal vendor update, manual configuration of the service path in the Windows Registry is the necessary step to neutralize this attack vector and prevent unauthorized escalation.

Description Summary:
Digital Crime Report Management System 1.0 contains a SQL injection vulnerability in multiple login endpoints that allows unauthenticated attackers to bypass authentication.

Executive Summary:
A critical SQL injection vulnerability in the Digital Crime Report Management System allows unauthenticated attackers to bypass authentication and gain unauthorized access to the application.

Vulnerability Details

CVE-ID: CVE-2021-47846

Affected Software: I Want Source Codes Digital Crime Report Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a classic SQL injection (CWE-89) triggered via crafted payloads in the email and password parameters of the police, incharge, user, and HQ login endpoints. An unauthenticated attacker can manipulate these input fields to bypass the authentication mechanism entirely.

Business Impact

The ability for an unauthenticated attacker to bypass authentication poses a severe risk to the confidentiality and integrity of sensitive crime report data. With a CVSS score of 8.2, this vulnerability could lead to total unauthorized access to the system, potentially resulting in data exfiltration, unauthorized modification of records, and significant reputational damage to the organization using the software.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the application login pages using network-level controls or by disabling the affected modules until the vendor provides a secure update.

Proactive Monitoring: Review web server and application access logs for anomalous POST requests to login endpoints containing SQL special characters, such as single quotes or boolean logic strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the identified login endpoints.

Exploitation Status

Public Exploit Available: Yes, a functional exploit is available via the Exploit-DB entry 49761.

Analyst Notes: As of January 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible, as it requires no prior authentication to execute.

Analyst Recommendation

Given the availability of a public exploit and the ease of execution, this vulnerability represents a high risk to any environment hosting the Digital Crime Report Management System. Organizations must treat this as a critical priority, implement immediate access restrictions, and seek an alternative solution if the vendor does not provide a definitive security update.

Description Summary:
Spy Emergency 25.0.650 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to execute code with elevated privileges.

Executive Summary:
A local privilege escalation vulnerability in Spy Emergency 25.0.650 allows low-privileged attackers to execute arbitrary code with system-level permissions.

Vulnerability Details

CVE-ID: CVE-2021-47845

Affected Software: NETGATE Spy Emergency

Affected Versions: 25.0.650

Vulnerability: The software contains an unquoted service path vulnerability (CWE-428) in the SpyEmergencyHealth.exe and SpyEmergencySrv.exe services. This flaw allows a local, authenticated attacker to place a malicious executable in a parent directory of the service path, which the system will then execute with LocalSystem privileges during service startup or restart.

Business Impact

The vulnerability presents a high risk to organizational security, as it allows for full system compromise from a standard user account. With a CVSS score of 7.8, this flaw facilitates lateral movement, data exfiltration, or the installation of persistent malware, effectively bypassing traditional user-level security boundaries.

Remediation Plan

Immediate Action: Since no specific patch is documented, administrators should verify if a newer version of Spy Emergency is available from the vendor and apply it immediately. If no update is available, consider restricting permissions on the installation directories to prevent unauthorized file placement.

Proactive Monitoring: Review Windows System and Security event logs for unexpected service restarts or file creation events within the C:\Program Files\NETGATE directory. Monitor for any processes spawning from the Spy Emergency service paths that do not match the expected vendor-signed binaries.

Compensating Controls: Implement strict file system permissions (Access Control Lists) on the installation paths to ensure only authorized administrators can write to the directory. Utilize Endpoint Detection and Response (EDR) solutions to flag or block unauthorized executable files being created in service-related paths.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the Exploit Database (EDB-ID 49997).

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable by any local user with the ability to write to the underlying file system.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the high impact of local privilege escalation, this vulnerability must be addressed with urgency. Administrators should prioritize updating the software or applying strict folder-level permissions to mitigate the risk of malicious service hijacking.

Description Summary:
StudyMD 0.3.2 is vulnerable to persistent cross-site scripting (XSS) via maliciously crafted markdown files, which can lead to remote code execution.

Executive Summary:
A persistent cross-site scripting vulnerability in StudyMD 0.3.2 allows an attacker to execute arbitrary code on the host system through malicious markdown files.

Vulnerability Details

CVE-ID: CVE-2021-47842

Affected Software: Jotron StudyMD

Affected Versions: 0.3.2

Vulnerability: The application fails to properly neutralize input when processing markdown files, allowing for the injection of persistent JavaScript payloads. This flaw can be triggered when a user opens a malicious file, enabling an attacker to execute arbitrary code with the privileges of the application.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to confidentiality, integrity, and availability. Because the vulnerability facilitates remote code execution, an attacker could potentially gain full control over the host machine, exfiltrate sensitive data, or deploy further malware. While the CVSS score is 7.2, the potential for remote code execution elevates the urgency of this advisory.

Remediation Plan

Immediate Action: There is no official patch currently available for this vulnerability. Users should immediately cease using the affected version of StudyMD until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor system logs for suspicious process spawning, particularly those involving unexpected shell commands or network connections originating from the StudyMD process.

Compensating Controls: Implement strict file validation policies to prevent the upload or opening of untrusted markdown files. Additionally, ensure the application is running with the least privilege necessary to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept and technical write-up are available via ExploitDB (EDB-ID 49832).

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of markdown processing in the application, which allows for complex JavaScript injection.

Analyst Recommendation

Given the capability for remote code execution and the availability of public exploit material, this vulnerability presents a high risk to organizational security. Administrators must prioritize isolating any systems running StudyMD 0.3.2 and restrict user access to file import features until a vendor-supplied security patch is verified and applied.

Description Summary:
Moeditor 0.2.0 is susceptible to persistent cross-site scripting (XSS) via malicious markdown files, allowing attackers to execute arbitrary JavaScript and potentially achieve remote code execution.

Executive Summary:
A persistent cross-site scripting vulnerability in Moeditor 0.2.0 allows attackers to execute arbitrary code on the host system when a malicious markdown file is opened.

Vulnerability Details

CVE-ID: CVE-2021-47840

Affected Software: Moeditor Moeditor

Affected Versions: 0.2.0

Vulnerability: The application fails to properly sanitize input within markdown files, enabling an attacker to embed malicious JavaScript payloads. When a victim opens a crafted file, the script executes, which can lead to remote code execution on the underlying system.

Business Impact

The vulnerability presents a severe risk as it allows for unauthorized code execution with the privileges of the user running the application. Successful exploitation could lead to full system compromise, data theft, or the installation of persistent malware. Given the CVSS score of 7.2, this issue is considered high severity and requires immediate attention to prevent potential exploitation.

Remediation Plan

Immediate Action: As no official patch is currently available, users should immediately cease using Moeditor 0.2.0 to process untrusted markdown files from unknown sources.

Proactive Monitoring: Review system logs for suspicious process spawning or unexpected outbound network connections originating from the Moeditor application.

Compensating Controls: Implement strict file handling policies that prohibit opening markdown files from unverified or external sources until a security update is released.

Exploitation Status

Public Exploit Available: Yes, a public exploit is available via ExploitDB (EDB-ID: 49830).

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it only requires a user to open a malicious markdown file, which triggers the payload execution.

Analyst Recommendation

Due to the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to organizational endpoints. Users are strongly advised to restrict the use of the affected software and monitor for any vendor-provided security updates. If an alternative editor exists, migration is recommended until the vendor addresses the underlying security flaw.

Description Summary:
Marky 0.0.1 is vulnerable to a persistent cross-site scripting flaw that allows attackers to inject malicious JavaScript into markdown files, potentially leading to remote code execution.

Executive Summary:
A persistent cross-site scripting vulnerability in Marky 0.0.1 allows attackers to execute arbitrary code on the host system when a malicious markdown file is opened.

Vulnerability Details

CVE-ID: CVE-2021-47839

Affected Software: vesparny Marky

Affected Versions: 0.0.1

Vulnerability: This is a persistent cross-site scripting (CWE-79) vulnerability occurring within the application's markdown editor. An attacker can craft a malicious markdown file containing JavaScript payloads that execute automatically upon the file being opened by a user, which can be leveraged to achieve remote code execution.

Business Impact

The ability for an attacker to execute arbitrary code on a user's machine creates a severe risk of system compromise, data theft, and unauthorized access to local environments. Given the CVSS score of 7.2, this vulnerability represents a high risk to organizational security, as it bypasses standard application boundaries and targets the underlying operating system of the user.

Remediation Plan

Immediate Action: As there is no official patch available for this version, users should immediately cease using the Marky 0.0.1 editor and remove the software from all systems until a secure version is released.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious child processes being spawned by the markdown editor or unauthorized outbound network connections initiated by the application.

Compensating Controls: Implement endpoint protection solutions that can detect and block malicious script execution patterns and restrict the ability of untrusted applications to execute system-level commands.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as detailed in the Exploit-DB entry 49831.

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it allows for direct command injection via the markdown file parsing mechanism.

Analyst Recommendation

Due to the potential for remote code execution, this vulnerability poses a significant threat to any environment where Marky is deployed. Organizations must prioritize the removal of this software to eliminate the risk, as no vendor-provided patch exists to remediate the underlying flaw.

Description Summary:
Markright 1.0 is vulnerable to persistent cross-site scripting (XSS) via maliciously crafted markdown files, which can be leveraged to achieve remote code execution on the host system.

Executive Summary:
A persistent cross-site scripting vulnerability in Markright 1.0 allows attackers to execute arbitrary JavaScript and potentially gain remote code execution on the underlying system.

Vulnerability Details

CVE-ID: CVE-2021-47838

Affected Software: Markright Markright

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize input within markdown files, leading to a persistent cross-site scripting (CWE-79) vulnerability. An authenticated attacker can upload a specially crafted markdown file that executes malicious payloads in the context of the user or system, potentially facilitating remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational security, as it allows for arbitrary code execution on systems running the vulnerable software. This could lead to full system compromise, unauthorized access to sensitive data, and potential lateral movement within the network. Given the CVSS score of 7.2, this vulnerability represents a high-risk entry point that should be prioritized for remediation.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict the ability to upload or load markdown files from untrusted sources.

Proactive Monitoring: Review application logs for unusual file upload activities or unexpected JavaScript execution patterns within the editor environment.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious markdown content or scripts before they reach the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the Exploit-DB entry 49834.

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of the markdown parser failing to neutralize embedded malicious scripts.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant threat. Organizations currently using Markright 1.0 must treat this as a high-priority issue. Until a vendor-supplied update or patch is released, strict access controls and rigorous input validation are necessary to mitigate the risk of exploitation.

Description Summary:
Markdownify 1.2.0 is vulnerable to persistent cross-site scripting, allowing attackers to execute arbitrary code via maliciously crafted markdown files.

Executive Summary:
A persistent cross-site scripting vulnerability in Markdownify 1.2.0 allows attackers to achieve remote code execution through the injection of malicious payloads into markdown files.

Vulnerability Details

CVE-ID: CVE-2021-47837

Affected Software: Markdownify

Affected Versions: 1.2.0

Vulnerability: The application fails to properly neutralize user-supplied input within markdown files, leading to a persistent cross-site scripting (CWE-79) condition. An attacker can leverage this flaw to execute arbitrary JavaScript within the application context, which, due to the nature of the software, enables remote code execution on the host machine.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host system. By executing arbitrary code, an attacker could gain full control over the local environment, potentially leading to unauthorized access to sensitive files, data exfiltration, or the installation of persistent malware. Although the CVSS score is 7.2, the potential for remote code execution elevates the operational urgency significantly.

Remediation Plan

Immediate Action: Users should immediately upgrade to a version of Markdownify that addresses this vulnerability, or discontinue use of the software until a secure update is verified.

Proactive Monitoring: Security teams should monitor file system activity for unexpected child process creation or unauthorized network connections originating from the Markdownify application.

Compensating Controls: Implement endpoint protection solutions capable of detecting and blocking malicious script execution and unauthorized shell command invocations.

Exploitation Status

Public Exploit Available: Yes, a public exploit is available via the Exploit-DB entry (EDB-ID 49835).

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it allows for the execution of arbitrary commands via crafted markdown files.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for remote code execution. Administrators must prioritize updating the application to the latest secure version. Until an update is applied, users should avoid opening untrusted or externally sourced markdown files within the application to prevent accidental payload execution.

Description Summary:
Freeter 1.2.1 is vulnerable to persistent cross-site scripting (XSS), allowing attackers to store malicious payloads in custom widget titles and files that execute upon victim interaction.

Executive Summary:
A persistent cross-site scripting vulnerability in Freeter version 1.2.1 enables remote code execution, posing a critical security risk to user workstations.

Vulnerability Details

CVE-ID: CVE-2021-47835

Affected Software: Freeter Freeter

Affected Versions: 1.2.1

Vulnerability: This is a persistent cross-site scripting (CWE-79) vulnerability where an attacker can inject malicious scripts into custom widget titles or files. When a victim interacts with these objects, the payload executes in the context of the application, which may allow an attacker to achieve remote code execution on the host machine.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running the application. This could lead to full system compromise, theft of sensitive project data, or unauthorized access to internal resources. Given the CVSS score of 7.2, this vulnerability is categorized as High severity and requires immediate attention to prevent potential data breaches or operational disruption.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor for this specific version. Users should restrict the use of custom widgets and avoid opening untrusted project files until a secure version is released.

Proactive Monitoring: Security teams should monitor workstation endpoint logs for unusual child processes spawned by the Freeter application, such as command shells or unauthorized network connections.

Compensating Controls: Since this is a client-side application, standard web application firewalls are ineffective; however, deploying endpoint detection and response (EDR) solutions can help identify and block suspicious process execution chains initiated by the software.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the Exploit-DB entry 49833.

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly concerning because the application architecture allows for the escalation of a standard XSS attack into full remote code execution.

Analyst Recommendation

The presence of a functional proof-of-concept that demonstrates remote code execution elevates the urgency of this advisory. Organizations using Freeter 1.2.1 should treat this as a high-priority risk and implement strict access controls regarding project file imports. Users are advised to monitor the vendor website for security updates and apply them immediately upon release to remediate this flaw.

Description Summary:
WifiHotSpot 1.0.0.0 is vulnerable to an unquoted service path flaw in the WifiHotSpotService.exe executable, allowing local attackers to achieve privilege escalation to LocalSystem.

Executive Summary:
A local privilege escalation vulnerability in Gearboxcomputers WifiHotSpot allows attackers to execute arbitrary code with LocalSystem permissions by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47833

Affected Software: Gearboxcomputers WifiHotSpot

Affected Versions: 1.0.0.0

Vulnerability: The application utilizes an unquoted service path for the WifiHotSpotService.exe binary. A local attacker can place a malicious executable in a directory within the path, which the service will then execute with elevated LocalSystem privileges upon system startup or reboot.

Business Impact

Successful exploitation of this vulnerability grants an attacker full administrative control over the affected host. This presents a critical risk of complete system compromise, including the potential for data exfiltration, installation of persistent backdoors, and lateral movement within the network. While the CVSS score of 7.8 reflects a high severity, the requirement for local access prevents this from being ranked as critical.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should manually move or rename the affected service executable to a path that does not contain spaces, or apply appropriate quotes to the service image path in the Windows Registry (HKLM\SYSTEM\CurrentControlSet\Services).

Proactive Monitoring: Monitor system logs for unauthorized service installations or modifications, and review the integrity of directories within the C:\Program Files (x86)\ path for suspicious executable files.

Compensating Controls: Implement strict file system permissions on the installation directory to prevent non-privileged users from writing or modifying files within the application folder.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 49845).

Analyst Notes: As of January 18, 2026, there is no public information indicating active exploitation in the wild, though a published proof-of-concept exists via Exploit-DB. The vulnerability is inherently exploitable by any local user with sufficient permissions to write to the application directory.

Analyst Recommendation

Given the potential for full system compromise via privilege escalation, it is imperative that organizations running this software identify and remediate the unquoted service path immediately. Administrators should prioritize modifying the service configuration to include proper quoting or relocating the binary to a secure, non-space-containing path to mitigate the risk of malicious code execution during system startup.

Description Summary:
A vulnerability exists in Sandboxie Plus that may allow for unauthorized system interaction. The specific nature of the flaw is currently under investigation.

Executive Summary:
Sandboxie Plus contains an identified security vulnerability that requires immediate administrative review to prevent potential system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47832

Affected Software: Sandboxie Sandboxie Plus

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the isolation capabilities of Sandboxie Plus, though specific technical details regarding the affected function or required authentication levels remain undocumented.

Business Impact

The potential for unauthorized system interaction poses a risk to the integrity of the sandboxing environment, which is designed to protect host systems from untrusted applications. Given the CVSS score of 7.8, this vulnerability is considered High severity, as it could lead to privilege escalation or security boundary bypass if exploited successfully.

Remediation Plan

Immediate Action: Consult the official Sandboxie vendor security advisories to determine if your specific version is impacted and apply available patches immediately.

Proactive Monitoring: Review system and application logs for unusual execution patterns or unauthorized attempts to access restricted directories from within the sandbox.

Compensating Controls: Ensure that the host operating system is fully patched and that administrative privileges are restricted to the minimum necessary for standard operations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of detailed technical documentation necessitates a cautious approach until the vendor provides further clarity.

Analyst Recommendation

Organizations utilizing Sandboxie Plus should prioritize this entry in their vulnerability management lifecycle. Because the technical specifics are currently opaque, IT teams must proactively monitor vendor communication channels and verify their current deployment versions against the latest security releases to ensure the environment remains protected.

Description Summary:
A denial of service vulnerability in Sandboxie 5.49.7 allows attackers to crash the application by overflowing the container folder input field with a large buffer of characters.

Executive Summary:
A denial of service vulnerability in Sandboxie 5.49.7 can be exploited by a local attacker to crash the application, resulting in a loss of containerized security controls.

Vulnerability Details

CVE-ID: CVE-2021-47831

Affected Software: Sandboxie Sandboxie-Plus

Affected Versions: 5.49.7

Vulnerability: This is an improper input validation flaw (CWE-1284) occurring within the container folder setting, where the application fails to handle excessively long input strings. The vulnerability can be triggered by a local attacker, regardless of their privilege level, provided they have the ability to interact with the Sandboxie interface.

Business Impact

The successful exploitation of this vulnerability results in an application crash, which disrupts the availability of the sandbox environment. While the impact is localized to the application, it compromises the security posture of systems relying on Sandboxie for process isolation, potentially leaving underlying host processes exposed if the sandbox fails to initialize or maintain its state. The CVSS score of 7.5 reflects the potential for service disruption, though the requirement for local access mitigates the risk of remote, large-scale compromise.

Remediation Plan

Immediate Action: Update Sandboxie-Plus to a version released after 5.49.7, where input validation for the container folder field has been corrected.

Proactive Monitoring: Monitor system event logs and application crash dumps for signs of repetitive application failures or unexpected shutdowns of the Sandboxie service.

Compensating Controls: Restrict access to the machine to authorized users only, as the vulnerability requires local access to the application interface to trigger the crash.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49844.

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently simple to exploit, requiring only the submission of a large character string to a specific configuration field.

Analyst Recommendation

The vulnerability in Sandboxie 5.49.7 presents a credible risk for service disruption through a straightforward denial of service attack. Organizations utilizing this software should prioritize updating to a patched version to ensure the integrity and availability of their sandboxing environment. Immediate application of updates is the only effective way to prevent this specific crash condition.