Description Summary:
Allok Video Converter 4.6.1217 contains a stack overflow vulnerability in the License Name field, allowing attackers to execute arbitrary code via SEH handler overwrites.

Executive Summary:
A stack-based buffer overflow in Allok Video Converter allows an attacker to execute arbitrary system commands by providing a specially crafted payload in the License Name input field.

Vulnerability Details

CVE-ID: CVE-2020-37184

Affected Software: Allok Soft Allok Video Converter

Affected Versions: 4.6.1217

Vulnerability: This is a stack overflow vulnerability located in the License Name input field. By injecting malicious bytecode, an attacker can overwrite Structured Exception Handler (SEH) records to gain control of the execution flow and execute arbitrary code.

Business Impact

Successful exploitation allows for full system compromise on the machine running the software. Given the CVSS score of 9.8, the risk is critical; an attacker could gain a foothold in the corporate network, install persistent malware, or steal sensitive user data.

Remediation Plan

Immediate Action: Discontinue the use of Allok Video Converter version 4.6.1217 and update to the latest available version provided by the vendor.

Proactive Monitoring: Monitor endpoint detection and response (EDR) systems for unusual process spawning from the Allok Video Converter executable.

Compensating Controls: Implement application whitelisting and restrict administrative privileges for end-users to limit the impact of a successful software-based exploit.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late-disclosure vulnerability from 2020, published in 2026. While no active exploitation is currently reported, the technical details provided make the creation of a functional exploit highly feasible for skilled actors.

Analyst Recommendation

Because this vulnerability allows for remote code execution via a simple input field, it is classified as critical. Organizations should immediately identify and update or remove this software from all workstations to mitigate the risk of local privilege escalation or remote compromise.

Description Summary:
Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 contains a stack overflow in the License Name input field, allowing attackers to overwrite SEH registers and execute arbitrary code.

Executive Summary:
Allok Converter software is vulnerable to a stack-based buffer overflow that allows attackers to execute arbitrary system commands via a malicious license input.

Vulnerability Details

CVE-ID: CVE-2020-37183

Affected Software: Allok RM RMVB to AVI MPEG DVD Converter

Affected Versions: 3.6.1217

Vulnerability: A stack overflow vulnerability exists in the License Name input field of the application. By entering a specially crafted, overly long string, an attacker can overwrite the Structured Exception Handler (SEH) registers to execute arbitrary code.

Business Impact

This flaw allows an attacker to execute system commands, such as launching applications or downloading malware, under the context of the current user. The CVSS score of 9.8 indicates a critical risk to the integrity and confidentiality of the host system, particularly if the software is used in a business environment.

Remediation Plan

Immediate Action: Update the Allok Converter to the latest available version or replace it with a secure alternative.

Proactive Monitoring: Use host-based intrusion prevention systems (HIPS) to detect and block buffer overflow attempts against desktop applications.

Compensating Controls: Restrict the ability of standard users to install or run unapproved third-party software that may contain legacy vulnerabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This 2020 vulnerability was disclosed late. There is no evidence of widespread active exploitation, but the flaw remains a viable vector for local privilege escalation or initial execution.

Analyst Recommendation

Immediate action is required to either patch or remove this software. Legacy converters are frequent sources of buffer overflow vulnerabilities, and maintaining them poses an unnecessary risk to the organizational security posture.

Description Summary:
Redir 3.3 contains a stack-based buffer overflow in the doproxyconnect function, allowing unauthenticated attackers to cause a denial of service via memory corruption.

Executive Summary:
A stack-based buffer overflow in Redir 3.3 allows remote, unauthenticated attackers to crash the application, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37182

Affected Software: Troglobit Redir

Affected Versions: 3.3

Vulnerability: The application is vulnerable to a stack-based buffer overflow within the doproxyconnect function due to the use of the sprintf function without proper length validation. An unauthenticated attacker can supply oversized input to the proxy connection string, overwriting memory and causing a segmentation fault that terminates the process.

Business Impact

Successful exploitation of this vulnerability leads to an immediate denial of service, rendering the affected Redir instance unavailable. Given that the CVSS score is 7.5, the impact is considered High, as the flaw is remotely exploitable without requiring user interaction or authentication. Frequent service interruptions can disrupt critical network traffic redirection, leading to potential operational downtime for dependent systems.

Remediation Plan

Immediate Action: Upgrade to the latest version of Redir where this buffer overflow is patched. If an update is not immediately available, restrict access to the service to trusted IP addresses only.

Proactive Monitoring: Monitor system logs for segmentation faults or unexpected service terminations associated with the Redir process. Implement alerts for abnormal traffic patterns directed at the proxy port.

Compensating Controls: Deploy a Web Application Firewall or similar network security appliance to inspect and drop packets containing excessively long connection strings before they reach the Redir service.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via Exploit-DB (EDB-ID: 47919).

Analyst Notes: As of February 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to trigger by sending a crafted string to the vulnerable endpoint, making it a viable target for automated disruption.

Analyst Recommendation

This vulnerability presents a clear risk of service disruption for systems relying on Troglobit Redir. Organizations should prioritize updating the software to a patched version to eliminate the buffer overflow condition. If patching is delayed, network-level access controls should be strictly enforced to limit exposure to this unauthenticated attack vector.

Description Summary:
Torrent FLV Converter 1.51 Build 117 contains a stack overflow vulnerability in the registration code input, allowing attackers to execute arbitrary code via SEH overwrite on Windows 32-bit systems.

Executive Summary:
Torrent FLV Converter is vulnerable to a stack-based buffer overflow that could allow an attacker to execute malicious code on the host system.

Vulnerability Details

CVE-ID: CVE-2020-37181

Affected Software: Torrent FLV Converter

Affected Versions: 1.51 Build 117

Vulnerability: A stack overflow vulnerability exists when processing registration codes. By providing a specially crafted input, an attacker can trigger a buffer overflow to overwrite the Structured Exception Handler (SEH), leading to arbitrary code execution on 32-bit Windows systems.

Business Impact

Exploitation allows for local code execution with the privileges of the user running the application. This could lead to data theft, malware installation, or system instability. The CVSS score of 9.8 reflects the high potential for impact, though exploitation typically requires the user to input a malicious string.

Remediation Plan

Immediate Action: Discontinue the use of the vulnerable version and update to a patched release or migrate to a supported alternative converter.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for suspicious process spawns (e.g., cmd.exe or powershell.exe) from the converter application.

Compensating Controls: Enable Windows security features such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) to make exploitation more difficult.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late disclosure of a 2020 vulnerability. As of Feb 11, 2026, there is no evidence of active exploitation, but the technical details for SEH overwrites are well-documented.

Analyst Recommendation

Users should avoid using legacy software that does not receive regular security updates. The primary recommendation is to update the software immediately or replace it with a modern, secure equivalent to mitigate the risk of code execution.

Description Summary:
GTalk Password Finder 2.2.1 contains a buffer overflow vulnerability that allows an attacker to cause a denial of service by supplying an oversized registration key to the application.

Executive Summary:
A buffer overflow vulnerability in Nsasoft GTalk Password Finder 2.2.1 allows an attacker to crash the application, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37180

Affected Software: Nsasoft GTalk Password Finder

Affected Versions: 2.2.1

Vulnerability: This is a classic buffer overflow (CWE-120) triggered by providing an excessively long input, specifically a 1000-character payload, into the Key field during the registration process. The vulnerability can be triggered by an unauthenticated local user or an attacker capable of providing input to the application interface.

Business Impact

While the CVSS score is 7.5, the primary impact is a denial of service, which disrupts the availability of the utility. Although this does not involve remote code execution, the ability to repeatedly crash the software can hinder administrative workflows that rely on the tool for password recovery or auditing, potentially resulting in operational downtime for specific tasks.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict access to the application to authorized personnel only and avoid entering untrusted registration keys.

Proactive Monitoring: Monitor system logs for repeated application crashes or unexpected terminations of the GTalk Password Finder executable.

Compensating Controls: Since this is a local application, ensure that host-based security policies prevent unauthorized users from executing or interacting with the software on sensitive workstations.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in ExploitDB entry 47942.

Analyst Notes: As of February 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is straightforward to trigger by inputting a long string into the registration field, which directly causes the application to crash.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, organizations should treat this vulnerability as a credible threat to availability. Users should exercise caution when inputting data into the registration module and limit the software installation to hardened endpoints where the risk of unauthorized local interaction is minimized.

Description Summary:
APKF Product Key Finder 2.5.8.0 is vulnerable to a buffer overflow in the registration name field, allowing an attacker to crash the application via a crafted 1000-character input.

Executive Summary:
A buffer overflow vulnerability in Nsasoft APKF Product Key Finder 2.5.8.0 allows an attacker to trigger a denial of service through a specially crafted registration input.

Vulnerability Details

CVE-ID: CVE-2020-37179

Affected Software: Nsasoft APKF Product Key Finder

Affected Versions: 2.5.8.0

Vulnerability: The application fails to perform adequate size validation on the Name input field during the registration process, leading to a classic buffer overflow (CWE-120). This vulnerability can be triggered by an attacker without requiring authentication, though it requires user interaction to perform the registration steps.

Business Impact

Successful exploitation results in an application crash, causing a denial of service for the product key recovery functionality. While this impact is limited to the local instance, it disrupts administrative workflows and productivity for users relying on the software to manage product license keys.

Remediation Plan

Immediate Action: Discontinue use of version 2.5.8.0 and check the vendor website for an updated release that addresses this memory corruption flaw.

Proactive Monitoring: Monitor system logs for repeated application crashes or unexpected terminations of the APKF process, which may indicate exploitation attempts.

Compensating Controls: Restrict access to the application to authorized personnel only, and implement endpoint security controls that monitor for unauthorized memory access or process injection attempts.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 47937).

Analyst Notes: As of February 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to trigger by pasting a 1000-character string into the registration field.

Analyst Recommendation

The presence of a publicly available proof-of-concept necessitates immediate attention to this vulnerability. Organizations using Nsasoft APKF Product Key Finder should prioritize updating to the latest version to prevent potential service disruption and ensure the integrity of the application environment.

Description Summary:
KeePass Password Safe versions before 2.44 are vulnerable to a denial of service flaw in the help system, allowing attackers to crash the application via malicious HTML file drag and drop operations.

Executive Summary:
KeePass Password Safe versions prior to 2.44 contain a code injection vulnerability in the help system that can be leveraged to cause application instability and denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37178

Affected Software: KeePass Password Safe

Affected Versions: < 2.44

Vulnerability: The application fails to properly sanitize input within the help system's HTML handling component. An unauthenticated local attacker can trigger this vulnerability by dragging and dropping a specially crafted HTML file into the help interface, which may lead to application crashes or unauthorized code execution depending on the local environment.

Business Impact

Successful exploitation of this vulnerability can lead to a denial of service, rendering the password management software unusable. In a professional environment, this causes operational disruption for users who rely on the software for credential management. While the CVSS score of 7.5 indicates a high severity, the requirement for local interaction limits the scope of the threat compared to remote network attacks.

Remediation Plan

Immediate Action: Update the KeePass Password Safe installation to version 2.44 or later to patch the vulnerable HTML handling logic.

Proactive Monitoring: Monitor system logs for unexpected application crashes or anomalous behavior associated with the KeePass executable, particularly following user interface interactions.

Compensating Controls: Restrict user permissions to prevent the execution of untrusted or externally sourced HTML files on systems where KeePass is deployed.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept exploit is documented in the Exploit Database (EDB-ID: 47952).

Analyst Notes: As of February 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from improper control of code generation (CWE-94), which is inherently dangerous when processing user-supplied input in a privileged interface.

Analyst Recommendation

The vulnerability presents a significant risk to the availability of credential management systems. Organizations must prioritize upgrading to version 2.44 or newer across all endpoints to ensure the help system's HTML parsing component is secure. Failure to patch leaves systems susceptible to application-level denial of service attacks.

Description Summary:
BOOTP Turbo 2.0 is vulnerable to a stack-based buffer overflow that allows an attacker to cause a denial of service by corrupting the Structured Exception Handler chain.

Executive Summary:
A stack-based buffer overflow in Weird Solutions BOOTP Turbo 2.0 allows an unauthenticated attacker to crash the application via a malicious payload.

Vulnerability Details

CVE-ID: CVE-2020-37177

Affected Software: Weird Solutions BOOTP Turbo

Affected Versions: 2.0

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) triggered when the application processes a crafted input of 2196 bytes, which overwrites the Structured Exception Handler (SEH). The attacker requires no authentication to interact with the vulnerable logging input field, leading to an application crash and potential corruption of the SEH chain.

Business Impact

The primary risk posed by this vulnerability is the disruption of critical network services provided by the BOOTP Turbo application. Because the software is designed to handle boot configuration protocols, a successful denial of service attack could prevent client systems from correctly booting or obtaining network configurations. With a CVSS score of 7.5, the vulnerability represents a significant risk to availability, though it does not inherently grant remote code execution capabilities based on current evidence.

Remediation Plan

Immediate Action: As there is no official patch currently documented for this legacy software, administrators should restrict access to the BOOTP Turbo management interface to authorized personnel only.

Proactive Monitoring: Monitor system event logs for repeated application crashes or service restarts that may indicate an ongoing attempt to exploit the SEH corruption flaw.

Compensating Controls: Deploy host-based intrusion prevention systems or endpoint security solutions configured to detect and block malformed input patterns directed at the BOOTP Turbo binary.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists and is documented in the Exploit Database (EDB-ID: 47955).

Analyst Notes: As of February 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable via simple input manipulation in the logging configuration settings.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, users should consider this software end-of-life or highly vulnerable. Organizations should prioritize replacing BOOTP Turbo with a modern, supported alternative to eliminate the risk of service disruption. If the software must remain in production, it should be isolated within a restricted network segment with strictly enforced access controls.

Description Summary:
Torrent 3GP Converter 1.51 is vulnerable to a stack overflow via the registration dialog, allowing attackers to overwrite SEH registers and execute arbitrary code on the host system.

Executive Summary:
Torrent 3GP Converter contains a critical stack overflow vulnerability that permits arbitrary code execution through a malicious registration payload.

Vulnerability Details

CVE-ID: CVE-2020-37176

Affected Software: Torrent 3GP Converter

Affected Versions: 1.51

Vulnerability: The application is susceptible to a stack-based buffer overflow within its registration dialog. An attacker can craft a malicious payload that overwrites the Structured Exception Handler (SEH) registers, leading to the execution of arbitrary code when the overflow is triggered.

Business Impact

A successful exploit grants the attacker the ability to execute code with the same privileges as the application user. This could result in the installation of malware or unauthorized access to local files. The CVSS score of 9.8 reflects the critical potential for system-wide impact if the application is run with elevated privileges.

Remediation Plan

Immediate Action: Update to the latest version of Torrent 3GP Converter or uninstall the software if it is no longer required for business operations.

Proactive Monitoring: Monitor for suspicious child processes being created by the converter application, which may indicate successful shellcode execution.

Compensating Controls: Implement application whitelisting and ensure that users do not run media conversion software with administrative privileges.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late disclosure from 2020. While no active exploitation is currently reported, the vulnerability is a classic buffer overflow that is well-understood by threat actors.

Analyst Recommendation

The risk of arbitrary code execution necessitates immediate remediation. Organizations should prioritize updating the software or transitioning to a more modern, actively supported media conversion utility to ensure continued security.

Description Summary:
P2PWIFICAM2 for iOS version 10.4.1 is vulnerable to a buffer overflow in the Camera ID field, allowing an attacker to cause an application crash via a 257-character input string.

Executive Summary:
A buffer overflow vulnerability in the P2PWIFICAM2 application for iOS allows local attackers to trigger a denial of service by providing malformed input to the Camera ID field.

Vulnerability Details

CVE-ID: CVE-2020-37175

Affected Software: Ka Ming Cheung P2PWIFICAM2

Affected Versions: 10.4.1

Vulnerability: This is a classic buffer overflow (CWE-120) triggered by the application failing to perform bounds checking on the Camera ID input field. An attacker can crash the application by submitting a 257-character buffer, effectively denying service to the user of the monitoring software.

Business Impact

The successful exploitation of this vulnerability results in an application crash, which disrupts the availability of the P2PWIFICAM2 monitoring service. While the CVSS score of 7.5 reflects a high severity rating, the impact is primarily limited to a local denial of service on the affected iOS device. Organizations relying on this software for security monitoring should be aware that forced application termination prevents real-time video surveillance and alerts.

Remediation Plan

Immediate Action: Users should update the P2PWIFICAM2 application to the latest available version provided by the vendor to ensure the buffer overflow is addressed.

Proactive Monitoring: Security teams should monitor mobile device logs for unexpected application crashes or frequent restarts associated with the P2PWIFICAM2 process.

Compensating Controls: As this is a client-side mobile application vulnerability, there are limited network-level compensating controls, though enforcing mobile device management (MDM) policies can restrict the installation of vulnerable software versions.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID 47993).

Analyst Notes: As of February 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently simple to exploit, as it requires only the insertion of a specific character sequence into a user-accessible field.

Analyst Recommendation

The vulnerability presents a credible risk of service disruption for users of the P2PWIFICAM2 application. Administrators and individual users are strongly advised to verify their current version and update to the latest release immediately to remediate the buffer overflow condition. Failure to update may leave the application susceptible to trivial denial of service attacks.

Description Summary:
AVideo Platform 8.1 is vulnerable to an information disclosure flaw allowing unauthenticated attackers to enumerate user details, including password hashes, via the playlistsFromUser.json.php endpoint.

Executive Summary:
An unauthenticated information disclosure vulnerability in AVideo Platform 8.1 allows unauthorized actors to harvest sensitive user credentials and administrative metadata.

Vulnerability Details

CVE-ID: CVE-2020-37173

Affected Software: AVideo AVideo Platform

Affected Versions: 8.1

Vulnerability: The application fails to perform adequate authorization checks on the playlistsFromUser.json.php endpoint. By manipulating the users_id parameter, an unauthenticated attacker can force the application to return sensitive data, including email addresses, password hashes, and administrative status.

Business Impact

The exposure of user password hashes and administrative status poses a severe risk to organizational security. Successful exploitation enables attackers to perform credential stuffing or brute-force attacks against administrative accounts, potentially leading to a full system compromise. Given the CVSS score of 7.5, this high-severity flaw represents a significant threat to data confidentiality and platform integrity.

Remediation Plan

Immediate Action: Upgrade to a secure, supported version of the AVideo Platform immediately, as version 8.1 is confirmed to be vulnerable.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting the playlistsFromUser.json.php endpoint, specifically those containing sequential or suspicious numeric values in the users_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or restrict access to the /objects/playlistsFromUser.json.php endpoint from untrusted external networks.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in ExploitDB (EDB-ID 47997).

Analyst Notes: As of February 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to exploit as it requires no prior authentication or specialized tools beyond a standard web browser or HTTP client.

Analyst Recommendation

This vulnerability presents a clear and present danger to the confidentiality of your user base. Because the exploit mechanism is publicly documented and requires no authentication, the window for remediation is narrow. It is critical that administrators identify all instances of AVideo Platform 8.1 within their environment and apply the necessary patches or updates to prevent unauthorized data exfiltration.

Description Summary:
Ecommerce Systempay 1.0 uses a weak cryptographic implementation, allowing attackers to brute-force the production secret key and forge payment signatures.

Executive Summary:
A critical cryptographic weakness in Ecommerce Systempay 1.0 allows attackers to forge payment signatures and manipulate transaction data.

Vulnerability Details

CVE-ID: CVE-2020-37168

Affected Software: Ecommerce Systempay 1.0

Affected Versions: 1.0

Vulnerability: The software employs an insecure cryptographic implementation for its 16-character production secret key. An attacker can perform a brute-force attack on the key using captured POST requests, subsequently allowing for the forging of valid payment signatures.

Business Impact

With a CVSS score of 9.8, this flaw presents a direct financial risk. Attackers can manipulate transaction amounts and payment data, leading to significant financial losses, fraud, and potential regulatory penalties for non-compliance with payment processing standards (e.g., PCI-DSS).

Remediation Plan

Immediate Action: Upgrade to the latest version of the Ecommerce Systempay software and rotate all secret keys immediately.

Proactive Monitoring: Monitor payment transaction logs for inconsistencies, such as unexpected transaction amounts or signatures that do not match expected patterns.

Compensating Controls: Implement strict rate limiting on the payment endpoint to prevent brute-force attempts on the secret key.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Financial integrity is paramount; the ability to forge payment signatures effectively negates the security of the entire payment workflow. Organizations must prioritize upgrading this component and treat all transaction data processed through this version as potentially compromised.

Description Summary:
The ClamAV ClamBC bytecode interpreter contains a vulnerability in function name processing that allows attackers to manipulate bytecode and potentially execute malicious code.

Executive Summary:
A critical code injection vulnerability in the ClamAV ClamBC bytecode interpreter allows unauthenticated attackers to execute malicious code via manipulated function names.

Vulnerability Details

CVE-ID: CVE-2020-37167

Affected Software: Cisco ClamAV (ClamBC)

Affected Versions: All versions prior to 0.103.0-rc

Vulnerability: The vulnerability exists in the ClamBC bytecode interpreter due to improper input validation during function name processing. This allows an attacker to inject and execute malicious bytecode within the engine.

Business Impact

Exploitation of this vulnerability allows for arbitrary code execution, which can lead to full system compromise if the ClamAV process is running with elevated privileges. Given the CVSS score of 9.8, this poses a severe threat to any infrastructure relying on ClamAV for malware scanning and perimeter security.

Remediation Plan

Immediate Action: Upgrade all instances of ClamAV to version 0.103.0-rc or later to ensure the bytecode interpreter is properly secured.

Proactive Monitoring: Review system logs for signs of anomalous ClamAV process behavior or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Isolate scanning engines within restricted environments (sandboxing) to limit the potential impact of a successful remote code execution attack.

Exploitation Status

Public Exploit Available: Yes — an exploit entry exists on ExploitDB.

Analyst Notes: As of Feb 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of weaponized exploit code significantly increases the risk of successful targeting.

Analyst Recommendation

Organizations must prioritize updating their ClamAV installations immediately. The combination of a critical CVSS score and existing public exploit code necessitates an urgent response to prevent potential system-wide compromise.

Description Summary:
QuickDate 1.3.2 is vulnerable to SQL injection via the _located parameter in the find_matches endpoint, allowing unauthorized database information extraction.

Executive Summary:
A critical SQL injection vulnerability in QuickDate 1.3.2 allows unauthenticated remote attackers to extract sensitive database information, including user credentials.

Vulnerability Details

CVE-ID: CVE-2020-37163

Affected Software: QuickDate QuickDate

Affected Versions: 1.3.2

Vulnerability: The application fails to properly sanitize the _located parameter within the find_matches endpoint. An unauthenticated attacker can supply a crafted UNION-based SQL statement to execute arbitrary queries against the backend database.

Business Impact

Successful exploitation of this flaw poses a severe risk to data confidentiality and integrity. By leveraging this SQL injection, an attacker can extract sensitive information such as user credentials, database names, and system versions, potentially leading to a complete compromise of the application data. With a CVSS score of 8.2, this vulnerability is considered high severity and requires immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Update the QuickDate installation to a version that incorporates a patch for this SQL injection vulnerability. If a patch is unavailable, restrict access to the find_matches endpoint at the network or application level.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to the /find_matches endpoint, specifically looking for SQL syntax patterns or unexpected character strings in the _located parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application input parameters.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the Exploit-DB entry 48022.

Analyst Notes: As of February 8, 2026, there is no public information indicating widespread active exploitation in the wild; however, a published proof-of-concept exists via the cited Exploit-DB research, meaning the risk of exploitation is credible and elevated. The vulnerability is inherently easy to exploit due to the lack of input sanitization on the public-facing endpoint.

Analyst Recommendation

Given the availability of a functional exploit and the high CVSS score, organizations running QuickDate 1.3.2 must prioritize remediation. Organizations should verify if they are on an affected version and apply the necessary updates provided by the vendor immediately to mitigate the risk of data compromise. If immediate patching is not feasible, implement strict WAF filtering to block malicious requests targeting the vulnerable endpoint.

Description Summary:
A stack-based buffer overflow in Wedding Slideshow Studio 1.36 allows attackers to execute arbitrary code by supplying a malicious 1608-byte registration key.

Executive Summary:
Wedding Slideshow Studio 1.36 is susceptible to a critical buffer overflow that allows attackers to execute arbitrary code by supplying a 1608-byte payload in the registration key field.

Vulnerability Details

CVE-ID: CVE-2020-37162

Affected Software: Wedding Slideshow Studio Wedding Slideshow Studio

Affected Versions: 1.36

Vulnerability: A stack-based buffer overflow exists in the registration key input mechanism of the application. By providing a malicious payload of exactly 1608 bytes, an attacker can overwrite the stack and redirect execution flow to arbitrary commands.

Business Impact

The vulnerability facilitates complete system compromise through remote code execution. The CVSS score of 9.8 underscores the high risk, as an attacker could potentially use this flaw to install malware, steal sensitive user data, or disrupt business operations.

Remediation Plan

Immediate Action: Immediately update Wedding Slideshow Studio to the latest version or apply any available vendor patches specifically targeting the registration module.

Proactive Monitoring: Monitor for crashed application instances which may indicate failed or successful exploitation attempts involving stack exhaustion.

Compensating Controls: Deploy host-based intrusion prevention systems (HIPS) to detect and block stack-based overflow attempts in real-time.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 7, 2026, there is no public information indicating active exploitation of this vulnerability. This vulnerability is distinct from CVE-2020-37161 as it targets the registration key field rather than the name field.

Analyst Recommendation

The presence of multiple critical buffer overflows in the same version of this software indicates a significant lack of secure coding practices. Immediate updating is mandatory to mitigate the risk of arbitrary code execution.

Description Summary:
Wedding Slideshow Studio 1.36 contains a buffer overflow in the registration name field, allowing attackers to execute arbitrary system commands via a malicious payload.

Executive Summary:
A critical buffer overflow vulnerability in Wedding Slideshow Studio 1.36 allows attackers to execute arbitrary system commands by providing a malicious registration name.

Vulnerability Details

CVE-ID: CVE-2020-37161

Affected Software: Wedding Slideshow Studio Wedding Slideshow Studio

Affected Versions: 1.36

Vulnerability: This vulnerability is a classic buffer overflow located in the "registration name" input field. An attacker can craft a specially designed payload that, when entered into the registration field, triggers memory corruption and allows for the execution of arbitrary commands, such as launching system utilities.

Business Impact

Successful exploitation grants the attacker the ability to run code with the privileges of the logged-in user. With a CVSS score of 9.8, this flaw could be used as an entry point for further exploitation of the host system and the local network.

Remediation Plan

Immediate Action: Update Wedding Slideshow Studio to the latest version to address the improper handling of registration input.

Proactive Monitoring: Review application logs for unusually long strings entered into registration or configuration fields.

Compensating Controls: Implement application whitelisting to prevent the execution of unauthorized binaries or scripts spawned by the slideshow software.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 7, 2026, there is no public information indicating active exploitation of this vulnerability. The vulnerability demonstrates a fundamental failure in input validation within the registration module.

Analyst Recommendation

Due to the critical severity and the potential for remote code execution, it is recommended that this software be updated or removed immediately. Organizations should ensure that all third-party media software is included in regular vulnerability scanning cycles.

Description Summary:
Parallaxis Cuckoo Clock 5.0 is vulnerable to a buffer overflow in alarm scheduling, enabling shellcode execution via EIP and EBP register overwrites.

Executive Summary:
Parallaxis Cuckoo Clock 5.0 contains a critical memory corruption flaw that allows attackers to execute arbitrary shellcode by exploiting the alarm scheduling function.

Vulnerability Details

CVE-ID: CVE-2020-37159

Affected Software: Parallaxis Cuckoo Clock

Affected Versions: 5.0

Vulnerability: The application suffers from a buffer overflow within the alarm scheduling feature. By submitting a malicious payload exceeding 260 bytes, an attacker can overwrite critical memory registers, including EIP and EBP, allowing for the execution of arbitrary shellcode with the privileges of the application.

Business Impact

A successful exploit could lead to full remote code execution on the host machine. The CVSS score of 9.8 indicates that the vulnerability is easily exploitable and results in a total loss of confidentiality, integrity, and availability for the affected system.

Remediation Plan

Immediate Action: Update the Parallaxis Cuckoo Clock software to the most recent version or decommission the software if it is no longer required for business operations.

Proactive Monitoring: Scan for anomalous payloads in application-specific configuration files and monitor for unexpected changes to the EIP/EBP registers during runtime.

Compensating Controls: Utilize Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) at the operating system level to mitigate the effectiveness of buffer overflow attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 7, 2026, there is no public information indicating active exploitation of this vulnerability. Despite its age, the technical simplicity of the overflow makes it a prime target for automated exploitation tools.

Analyst Recommendation

This vulnerability presents a critical risk to endpoint security due to the potential for arbitrary code execution. Users are urged to apply the vendor-provided updates immediately to secure their systems against memory corruption attacks.

Description Summary:
DBPower C300 HD Camera contains a configuration disclosure vulnerability. Unauthenticated attackers can retrieve sensitive credentials via an unprotected configuration backup endpoint.

Executive Summary:
The DBPower C300 HD Camera suffers from a critical configuration disclosure vulnerability that allows unauthenticated attackers to steal sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2020-37157

Affected Software: DBPower C300 HD Camera

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves an unprotected configuration backup endpoint. An unauthenticated attacker can access this endpoint to download configuration files containing sensitive credentials and system settings without any form of authentication.

Business Impact

The impact of credential theft from an IoT device is severe, as it allows attackers to gain full administrative control over the camera. This could lead to unauthorized surveillance, loss of privacy, and the potential for the device to be recruited into a botnet. The CVSS score of 7.5 reflects the high risk associated with the ease of access to these sensitive credentials.

Remediation Plan

Immediate Action: Update the camera firmware to the latest version provided by DBPower to secure the backup endpoint.

Proactive Monitoring: Monitor for unusual outbound traffic from IoT devices and audit web server logs for hits on backup or configuration file paths.

Compensating Controls: Disable any unnecessary cloud or remote access features on the camera and ensure it is behind a robust firewall that restricts access to the web management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. This late-disclosure vulnerability is particularly dangerous because the exposure of credentials often leads to persistent access for attackers.

Analyst Recommendation

Immediate remediation is required to prevent the unauthorized disclosure of device credentials. Organizations and home users should verify firmware versions and ensure that these devices are not exposed to the public internet, as the unauthenticated nature of the flaw makes it highly exploitable.

Description Summary:
Core FTP Lite 1.3c contains a buffer overflow in the username input field, allowing unauthenticated attackers to cause an application crash via a specially crafted 7000-byte input payload.

Executive Summary:
A buffer overflow vulnerability in Core FTP Lite 1.3c allows unauthenticated attackers to trigger a denial of service condition through oversized input in the username field.

Vulnerability Details

CVE-ID: CVE-2020-37155

Affected Software: Core FTP Core FTP Lite

Affected Versions: 1.3c Build 1437

Vulnerability: This is a classic buffer overflow (CWE-120) triggered by providing a 7000-byte payload into the username input field. The vulnerability is exploitable by an unauthenticated attacker who has access to the application interface.

Business Impact

Successful exploitation results in a denial of service, rendering the Core FTP application unresponsive and necessitating a manual restart. While the CVSS score of 7.5 reflects a high impact on availability, the primary business risk involves the disruption of critical file transfer operations and potential loss of productivity for users relying on the software for data exchange.

Remediation Plan

Immediate Action: As no official patch is currently identified for this legacy version, users are advised to restrict access to the application and monitor vendor channels for any potential security updates or decommissioning notices.

Proactive Monitoring: Security teams should monitor system logs for unusual application crashes or repeated service failures associated with the Core FTP process.

Compensating Controls: Implement endpoint security policies to restrict the execution of unauthorized or outdated software and utilize host-based intrusion prevention systems to detect anomalous input patterns targeting the application.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via Exploit-DB (EDB-ID: 48100).

Analyst Notes: As of February 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to trigger, requiring only the submission of an oversized string to the target field.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, organizations still utilizing Core FTP Lite 1.3c should prioritize migrating to a modern, actively maintained file transfer solution. If migration is not immediately feasible, isolate affected systems from public networks to minimize exposure to potential exploitation attempts.

Description Summary:
Tripath Project eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to achieve remote code execution.

Executive Summary:
An authenticated SQL injection vulnerability in Tripath Project eLection 2.0 allows attackers to execute arbitrary commands on the underlying server, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2020-37154

Affected Software: Tripath Project eLection

Affected Versions: 2.0

Vulnerability: The application is vulnerable to SQL injection via the id parameter in the admin candidate management endpoint (op_kandidat.php). This flaw requires low-level administrative authentication to trigger, but it enables attackers to execute arbitrary system commands by uploading malicious files to the web directory.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve full remote code execution on the host server. Given the CVSS score of 7.1, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the administrative portal to trusted IP addresses only and disable the affected candidate management features if they are not mission-critical.

Proactive Monitoring: Monitor server logs for anomalous POST requests to the /election/admin/ajax/op_kandidat.php endpoint, particularly those containing SQL syntax or attempts to access newly created .php files in the web root.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the id parameter in administrative requests.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept and technical write-up are available via ExploitDB and GitHub.

Analyst Notes: As of February 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it allows for the automated deployment of web shells using tools like SQLMap.

Analyst Recommendation

Given the availability of public exploits and the catastrophic potential for remote code execution, this vulnerability demands immediate attention. Organizations currently utilizing eLection 2.0 should isolate the application from the public internet or decommission it until a secure alternative or vendor patch is provided.

Description Summary:
ASTPP 4.0.1 is vulnerable to XSS and command injection in SIP and plugin management interfaces, allowing attackers to hijack sessions and execute code with root permissions.

Executive Summary:
ASTPP 4.0.1 contains multiple critical flaws that enable attackers to gain root-level access and hijack administrator sessions through command injection and XSS.

Vulnerability Details

CVE-ID: CVE-2020-37153

Affected Software: ASTPP (Open Source Smart VoIP Billing Solution)

Affected Versions: 4.0.1

Vulnerability: The application suffers from multiple flaws including cross-site scripting (XSS) and command injection within the SIP device configuration and plugin management modules. Attackers can leverage these to inject system commands or manipulate cron tasks to achieve root-level code execution.

Business Impact

The compromise of a VoIP billing solution can lead to massive financial fraud, interception of sensitive communication data, and total system takeover. The CVSS score of 9.8 highlights the critical nature of these flaws, as they can lead to full administrative compromise and persistent access via cron manipulation.

Remediation Plan

Immediate Action: Upgrade ASTPP installations to the latest stable version where these vulnerabilities have been addressed.

Proactive Monitoring: Monitor system cron jobs for unauthorized changes and audit administrator session logs for suspicious activity or session hijacking indicators.

Compensating Controls: Use a WAF to filter malicious input in SIP configuration fields and enforce strict IP whitelisting for the management interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 11, 2026, there is no public information indicating active exploitation. This is a late disclosure of a 2020 vulnerability, suggesting that legacy systems may still be at risk.

Analyst Recommendation

Given the potential for root-level access and the sensitive nature of VoIP billing data, this vulnerability must be addressed with high urgency. Administrators should move away from version 4.0.1 immediately and conduct a thorough audit of their system configurations for any signs of past tampering.

Description Summary:
phpMyChat Plus 1.98 is vulnerable to SQL injection via the pmc_username parameter in deluser.php, allowing unauthenticated attackers to extract sensitive database information.

Executive Summary:
A critical SQL injection vulnerability in phpMyChat Plus 1.98 allows unauthenticated remote attackers to compromise database contents.

Vulnerability Details

CVE-ID: CVE-2020-37151

Affected Software: Ciprianmp phpMyChat Plus

Affected Versions: 1.98

Vulnerability: The application fails to properly sanitize user input in the pmc_username parameter within the deluser.php script. This flaw allows an unauthenticated attacker to inject malicious SQL queries, facilitating boolean-based, error-based, and time-based blind data extraction.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the underlying database, which may contain sensitive user credentials, personal information, or session data. Given the CVSS score of 8.2, this represents a significant risk to data confidentiality and integrity, potentially leading to total database compromise or service disruption.

Remediation Plan

Immediate Action: As no official patch is currently identified, users should restrict access to the deluser.php endpoint or disable the affected module entirely until a vendor-supplied update is available.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous SQL syntax, such as UNION SELECT statements, SLEEP commands, or unexpected database error messages originating from the deluser.php page.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, specifically targeting POST requests to the deluser.php file.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exploit is available via ExploitDB (EDB-ID 48066).

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the ease of automating data extraction using tools like sqlmap.

Analyst Recommendation

Given the availability of public exploit code and the critical nature of SQL injection, this vulnerability poses a severe threat to any environment hosting phpMyChat Plus. Administrators must prioritize limiting access to this application and implementing robust WAF filtering immediately to prevent unauthorized data exfiltration.

Description Summary:
The Edimax EW-7438RPn-v3 Mini allows unauthenticated attackers to disclose the Wi-Fi SSID and security key via the /wizard_reboot.asp page.

Executive Summary:
An unauthenticated information disclosure vulnerability in the Edimax EW-7438RPn-v3 Mini allows remote attackers to access sensitive Wi-Fi credentials.

Vulnerability Details

CVE-ID: CVE-2020-37150

Affected Software: Edimax EW-7438RPn-v3 Mini

Affected Versions: 1.23, 1.27

Vulnerability: The device contains an information disclosure flaw in the /wizard_reboot.asp endpoint, which permits unauthenticated users to retrieve wireless network settings, including the security key, through a simple GET request.

Business Impact

Successful exploitation allows unauthorized parties to obtain the Wi-Fi security key, effectively bypassing wireless network access controls. This exposure facilitates unauthorized network entry, potential data interception, and lateral movement within the environment. Given the CVSS score of 7.5, this vulnerability represents a high risk to the confidentiality of network communications and organizational security posture.

Remediation Plan

Immediate Action: Consult the official Edimax support portal to determine if a firmware update is available for your specific hardware unit and apply it immediately. If no update is available, isolate the device from public-facing networks.

Proactive Monitoring: Regularly audit network logs for unauthorized access attempts directed at the /wizard_reboot.asp or /goform/mp endpoints.

Compensating Controls: Deploy a Web Application Firewall or restrict access to the device management interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a functional exploit is available via ExploitDB (EDB-ID 48318).

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists in the form of an ExploitDB entry, so exploitation risk should be treated as credible. The device is also susceptible to remote code execution via other endpoints as documented in the same research, further increasing the necessity for immediate mitigation.

Analyst Recommendation

The presence of a published exploit, combined with the ease of access for unauthenticated attackers, makes this a high-priority risk. Administrators must prioritize updating the firmware or physically isolating affected devices to prevent unauthorized credential harvesting and subsequent network compromise.

Description Summary:
Edimax EW-7438RPn-v3 Mini firmware versions 1.23 and 1.27 are vulnerable to a cross-site request forgery flaw that allows an attacker to achieve arbitrary command execution on the device.

Executive Summary:
A cross-site request forgery vulnerability in Edimax EW-7438RPn-v3 Mini devices allows remote attackers to execute arbitrary commands, creating a significant risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2020-37149

Affected Software: Edimax EW-7438RPn-v3 Mini

Affected Versions: 1.23, 1.27

Vulnerability: The device is susceptible to a cross-site request forgery (CSRF) attack targeting the /goform/mp endpoint. An attacker can trick an authenticated user into executing malicious commands with the privileges of that user, leading to remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to gain remote code execution capabilities on the wireless range extender. This could enable an attacker to pivot into the local network, intercept traffic, or modify device configurations, leading to a complete loss of confidentiality and integrity for network communications. Given the CVSS score of 8.1, this represents a high-severity threat to business operations.

Remediation Plan

Immediate Action: Users should update the device firmware to the latest available version provided by Edimax. If an update is not available for this specific hardware, the device should be isolated from the public internet or replaced.

Proactive Monitoring: Network administrators should monitor for anomalous outbound traffic originating from the range extender, particularly connections to unknown external servers via HTTP or shell-related protocols.

Compensating Controls: Ensure the administrative interface is not exposed to the public internet. Implement strict network segmentation to limit the impact if the device is compromised.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 48318).

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of CSRF protection on the administrative command endpoint.

Analyst Recommendation

This vulnerability presents a severe risk because it allows for unauthorized command execution on network infrastructure. Organizations utilizing Edimax EW-7438RPn-v3 Mini devices must prioritize patching these systems immediately. If firmware updates cannot be applied, the devices should be decommissioned or restricted to non-critical network segments to prevent potential lateral movement.

Description Summary:
ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries via the 'id' parameter.

Executive Summary:
A SQL injection vulnerability in ATutor 2.2.4 allows authenticated administrators to perform unauthorized database operations, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2020-37147

Affected Software: ATutor ATutor

Affected Versions: 2.2.4

Vulnerability: The application fails to properly sanitize input within the 'id' parameter of the admin_delete.php script. This flaw allows an authenticated attacker with administrative privileges to inject malicious SQL commands, potentially leading to unauthorized data extraction or modification.

Business Impact

Successful exploitation of this vulnerability could lead to the compromise of sensitive information stored within the application database. Given the CVSS score of 7.1, this is classified as a high-severity issue, as it permits an attacker to bypass standard database controls. The potential for unauthorized data manipulation poses a significant threat to both system integrity and regulatory compliance.

Remediation Plan

Immediate Action: As no official patch is currently identified for this legacy version, administrators should restrict access to the administrative panel to trusted IP addresses only. If the functionality is not required, disable the affected admin_delete.php script or the associated module.

Proactive Monitoring: Review web server and application logs for anomalous SQL syntax patterns or unexpected database query activity originating from administrative accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns specifically targeting the 'id' parameter in the identified script.

Exploitation Status

Public Exploit Available: Yes, a functional exploit is available via Exploit-DB (EDB-ID 48117).

Analyst Notes: As of February 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user possessing valid administrative credentials.

Analyst Recommendation

Given the availability of public exploit code and the high-severity nature of SQL injection, immediate mitigation is required. Organizations still utilizing ATutor 2.2.4 must implement the suggested compensating controls and restrict administrative access until a permanent patch or migration to a supported version can be performed.

Description Summary:
ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability. Unauthenticated attackers can remotely retrieve sensitive configuration files from the device.

Executive Summary:
The ACE Security WiP-90113 HD Camera is vulnerable to an unauthenticated configuration disclosure flaw that allows attackers to steal sensitive device information.

Vulnerability Details

CVE-ID: CVE-2020-37146

Affected Software: ACE Security WiP-90113 HD Camera

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability is a configuration disclosure flaw that allows an unauthenticated, remote attacker to retrieve sensitive configuration files. The lack of proper access controls on the device's web interface enables the extraction of critical system settings.

Business Impact

The exposure of configuration files represents a critical privacy and security breach. Attackers can use the extracted data to gain deeper access to the camera, potentially viewing live feeds or using the device as a pivot point into the local network. With a CVSS score of 7.5, this vulnerability threatens the physical security and data privacy of the environment where the camera is deployed.

Remediation Plan

Immediate Action: Apply the latest firmware update from ACE Security to address the insecure configuration endpoint.

Proactive Monitoring: Inspect network traffic for unauthorized HTTP requests targeting configuration paths on IoT camera devices.

Compensating Controls: Place IP cameras on a segmented VLAN with no direct access to the internet and implement strict firewall rules to block unauthorized inbound traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. Despite being a late disclosure, the unauthenticated nature of the flaw makes it a high-priority target for automated scanners.

Analyst Recommendation

The ability for unauthenticated users to pull sensitive configuration data is a major security failure. Administrators must ensure that all ACE Security WiP-90113 cameras are updated immediately and isolated from public-facing networks to mitigate the risk of unauthorized surveillance or network intrusion.

Description Summary:
ProficySCADA for iOS version 5.0.25920 is susceptible to a denial of service vulnerability triggered by providing an excessively long string to the password input field.

Executive Summary:
A denial of service vulnerability in GE Intelligent Platforms ProficySCADA for iOS allows an attacker to crash the application, resulting in a loss of service for authorized users.

Vulnerability Details

CVE-ID: CVE-2020-37143

Affected Software: GE Intelligent Platforms ProficySCADA

Affected Versions: 5.0.25920

Vulnerability: The application fails to properly limit the resources allocated to the password input field, allowing an unauthenticated attacker to trigger a crash by submitting 257 bytes of repeated characters. This flaw resides in the authentication process and leads to a resource exhaustion state.

Business Impact

The ability to remotely or locally crash the SCADA interface can significantly impede operational visibility and control, leading to potential downtime for critical monitoring systems. While the CVSS score of 7.5 indicates a high technical severity, the impact is primarily focused on availability rather than data compromise, though the interruption of industrial oversight poses a substantial risk to business continuity.

Remediation Plan

Immediate Action: As no official patch is documented, users should restrict access to the device and monitor for potential crash events until the vendor provides a formal update.

Proactive Monitoring: Security teams should monitor device logs for unexpected application termination events or repeated authentication failures that may indicate an attempt to trigger this crash.

Compensating Controls: Ensure that mobile device management policies are in place to limit unauthorized access to the application, and consider using endpoint security solutions capable of detecting abnormal application behavior.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID 48236).

Analyst Notes: As of February 7, 2026, there is no public information indicating active exploitation in the wild, though a functional proof of concept exists which makes the vulnerability easily reproducible. The nature of the flaw, which relies on a simple buffer-related crash, suggests it is trivial to execute.

Analyst Recommendation

Given the availability of a public proof of concept and the critical nature of SCADA software, this vulnerability represents a credible risk to availability. Organizations utilizing this application should prioritize limiting its exposure to untrusted users and contact the vendor for confirmation regarding the availability of a security update or a hardened version of the software.

Description Summary:
10-Strike Network Inventory Explorer 8.54 is vulnerable to a stack-based buffer overflow via the Computer parameter, allowing unauthenticated local attackers to execute arbitrary code.

Executive Summary:
A critical stack-based buffer overflow vulnerability in 10-Strike Network Inventory Explorer 8.54 allows for potential remote code execution via malicious input.

Vulnerability Details

CVE-ID: CVE-2020-37142

Affected Software: 10-Strike Software Network Inventory Explorer

Affected Versions: 8.54

Vulnerability: The application is susceptible to a stack-based buffer overflow through improper handling of structured exception handler (SEH) records. By injecting a crafted payload into the Computer parameter during the Add function, an attacker can overwrite the SEH chain and achieve arbitrary code execution.

Business Impact

The vulnerability carries a high CVSS score of 8.4, reflecting the significant risk of full system compromise. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the application, potentially leading to unauthorized data access, system instability, or the installation of persistent malicious software.

Remediation Plan

Immediate Action: Upgrade to the latest version of 10-Strike Network Inventory Explorer provided by the vendor, as this version is confirmed vulnerable.

Proactive Monitoring: Review system logs for unusual application crashes or repeated exception events associated with the Network Inventory Explorer processes, which may indicate exploitation attempts.

Compensating Controls: Ensure that the application is running with the least privilege necessary and restrict access to the host machine to authorized personnel only, as this is a local attack vector.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit Database (EDB-ID 48253) and associated researcher technical documentation.

Analyst Notes: As of February 7, 2026, there is no public information indicating active exploitation in the wild. However, the availability of a functional proof-of-concept exploit makes this vulnerability highly dangerous for unpatched environments.

Analyst Recommendation

Given the potential for arbitrary code execution and the availability of public exploit material, this vulnerability should be treated with high urgency. Administrators are advised to apply the vendor-supplied security updates immediately to mitigate the risk of exploitation.

Description Summary:
AMSS++ version 4.31 contains a SQL injection vulnerability in the maildetail.php script, allowing unauthenticated attackers to manipulate the 'id' parameter to access or modify database contents.

Executive Summary:
A critical SQL injection vulnerability in AMSS++ version 4.31 allows unauthenticated remote attackers to compromise backend database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2020-37141

Affected Software: AMSS++ AMSS++

Affected Versions: 4.31

Vulnerability: This vulnerability is a SQL injection flaw located within the mail module of the application. An unauthenticated attacker can supply malicious SQL queries via the 'id' parameter in the maildetail.php script to execute unauthorized database commands.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL queries poses a severe risk to the confidentiality and integrity of the entire database. Successful exploitation could lead to unauthorized data exfiltration, modification of user records, or potential administrative account takeover, resulting in significant operational disruption and reputational damage. With a CVSS score of 8.2, this vulnerability represents a high-severity threat that requires immediate attention.

Remediation Plan

Immediate Action: As there is currently no official patch available, administrators should restrict access to the vulnerable /modules/mail/main/maildetail.php endpoint at the network or web server level.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax or unusual characters directed at the maildetail.php script.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the vendor releases a formal fix.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the Exploit Database (EDB-ID: 48109).

Analyst Notes: As of February 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the predictable nature of the vulnerable parameter.

Analyst Recommendation

Given the high CVSS score and the public availability of a proof-of-concept, the risk of exploitation is elevated. Organizations currently running AMSS++ version 4.31 must prioritize isolating the affected module or implementing robust WAF filtering immediately. Continuous monitoring for indicators of compromise is essential until the vendor provides a permanent software update.

Description Summary:
Odin Secure FTP Expert 7.6.3 is vulnerable to a local buffer overflow caused by oversized input in connection fields, allowing an attacker to crash the application.

Executive Summary:
A local denial of service vulnerability in Odin Secure FTP Expert 7.6.3 allows an unauthenticated attacker to crash the application via buffer overflow.

Vulnerability Details

CVE-ID: CVE-2020-37139

Affected Software: Odin Secure FTP Expert

Affected Versions: 7.6.3

Vulnerability: The application fails to properly limit the allocation of resources when processing site information fields, allowing an unauthenticated local user to trigger a buffer overflow by inputting 108 characters into connection fields. This flaw, classified under CWE-770, results in an immediate application crash.

Business Impact

The exploitation of this vulnerability results in the disruption of file transfer services, leading to potential operational downtime for users relying on the software for data movement. While the CVSS score of 8.4 suggests a high severity, the impact is strictly limited to a local denial of service, meaning the business risk is primarily centered on availability and process continuity rather than data exfiltration or unauthorized system access.

Remediation Plan

Immediate Action: There is no vendor-supplied patch for this legacy software; users should discontinue use of Odin Secure FTP Expert 7.6.3 and migrate to a modern, actively maintained FTP client.

Proactive Monitoring: Security teams should monitor workstation and server logs for abnormal application termination events or unexpected process crashes associated with the FTP client.

Compensating Controls: Ensure that workstations are configured with strict local access controls to prevent unauthorized users from interacting with the application interface.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 48262).

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to trigger, requiring only the input of a specifically crafted character string into the application interface.

Analyst Recommendation

Given that Odin Secure FTP Expert 7.6.3 is no longer supported and lacks a security patch, the risk of continued use is significant. Organizations should audit their environments to identify any remaining installations of this software and prioritize the migration to a secure, supported alternative to eliminate this denial of service risk entirely.

Description Summary:
A stack-based buffer overflow in the 10-Strike Network Inventory Explorer file import functionality allows remote attackers to execute arbitrary code via a malicious text file.

Executive Summary:
A critical buffer overflow vulnerability in 10-Strike Network Inventory Explorer allows remote attackers to execute arbitrary code by tricking a user into importing a malicious file.

Vulnerability Details

CVE-ID: CVE-2020-37138

Affected Software: 10-Strike Network Inventory Explorer

Affected Versions: 9.03

Vulnerability: The vulnerability exists in the file import feature. By crafting a malicious text file with a specifically constructed payload, an attacker can trigger a stack-based buffer overflow. This allows the attacker to bypass Data Execution Prevention (DEP) using a ROP chain and execute arbitrary code on the system.

Business Impact

Network Inventory Explorer is typically used by system administrators to manage corporate assets. A compromise of this tool could allow an attacker to gain administrative access to the management workstation, leading to the theft of network topology data, credentials, and potential lateral movement. The CVSS score of 9.8 underscores the severe impact of this RCE flaw.

Remediation Plan

Immediate Action: Update 10-Strike Network Inventory Explorer to the latest version. Avoid importing files from untrusted or unknown sources until the update is applied.

Proactive Monitoring: Use Endpoint Detection and Response (EDR) tools to monitor the Network Inventory Explorer process for suspicious child processes or memory anomalies.

Compensating Controls: Restrict the application's permissions to the minimum required for its function and use sandboxing for file import operations where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This 2020 vulnerability was disclosed in 2026. The use of ROP chains indicates a sophisticated exploitation path that can bypass modern OS protections like DEP.

Analyst Recommendation

Because this tool is central to asset management, its security is paramount. We recommend an immediate update to the latest version provided by 10-Strike Software. Administrators should be cautioned against importing inventory data from any source that has not been strictly verified, as this is the primary infection vector.

Description Summary:
ZOC Terminal 7.25.5 is vulnerable to a stack-based buffer overflow in the private key file input field, allowing an attacker to cause a denial of service.

Executive Summary:
A stack-based buffer overflow in ZOC Terminal 7.25.5 allows a local attacker to crash the application, resulting in a denial of service condition.

Vulnerability Details

CVE-ID: CVE-2020-37136

Affected Software: EmTec ZOC Terminal

Affected Versions: 7.25.5

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) triggered when a user inputs an excessively long string into the private key file field. The application fails to properly validate the input size, allowing a 2000-byte buffer to overwrite memory and cause the application to become unresponsive.

Business Impact

The primary impact of this vulnerability is the loss of availability for the ZOC Terminal application. While the CVSS score of 7.5 indicates a high severity, the requirement for local interaction limits the scope of the threat. Unexpected application crashes can disrupt workflows and administrative tasks that rely on secure shell connectivity, potentially impacting operational efficiency.

Remediation Plan

Immediate Action: Update to the latest version of ZOC Terminal, as the vendor has addressed the memory handling flaw in subsequent releases.

Proactive Monitoring: Review system logs for signs of application instability or frequent service restarts associated with the ZOC Terminal process.

Compensating Controls: Ensure that users are trained to avoid pasting untrusted or malformed data into application input fields, which serves as a basic defense against manual exploitation attempts.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 48292).

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently simple to trigger, requiring only the submission of a crafted string into the GUI.

Analyst Recommendation

Organizations utilizing ZOC Terminal 7.25.5 should prioritize upgrading to a patched version to eliminate this denial of service risk. Although exploitation requires local access, the availability of a public proof-of-concept lowers the barrier for potential attackers to disrupt critical terminal operations. Immediate patching remains the most effective method to ensure application stability and security.

Description Summary:
AMSS++ version 4 is affected by a high-severity vulnerability. This late-disclosure entry indicates a significant security flaw within the application's core logic.

Executive Summary:
AMSS++ version 4 contains a high-severity security vulnerability that poses a significant risk to the integrity and availability of the affected system.

Vulnerability Details

CVE-ID: CVE-2020-37135

Affected Software: AMSS++

Affected Versions: AMSS++ 4

Vulnerability: This vulnerability affects AMSS++ version 4 and is characterized as a high-severity security flaw. Based on the late disclosure and CVSS score, the vulnerability likely permits an attacker to bypass security controls or execute unauthorized actions within the application environment.

Business Impact

The impact of this vulnerability is substantial, as evidenced by the CVSS score of 7.5. Successful exploitation could lead to unauthorized data access, system instability, or the compromise of administrative functions. For organizations utilizing this legacy software, the risk includes potential data loss and non-compliance with security standards due to the age and nature of the software.

Remediation Plan

Immediate Action: Users should immediately upgrade to a supported version of the software or apply specific vendor-provided patches for version 4.

Proactive Monitoring: Review system access logs for any historical signs of unauthorized logins or unusual administrative changes that may have occurred prior to this disclosure.

Compensating Controls: If patching is not immediately feasible, isolate the AMSS++ server from the public internet and restrict access to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, this is a late disclosure of a 2020 vulnerability, which may mean exploitation techniques are already known in specialized circles.

Analyst Recommendation

Given the late disclosure and the high severity of the flaw, organizations must prioritize the remediation of AMSS++ installations. The most effective course of action is to migrate to a modern, supported platform or apply the necessary security updates to version 4 without delay.

Description Summary:
UltraVNC Viewer 1.2.4.0 is susceptible to a denial of service vulnerability caused by improper input validation, allowing an attacker to crash the application using a malformed payload.

Executive Summary:
A denial of service vulnerability in UltraVNC Viewer 1.2.4.0 allows unauthenticated attackers to crash the application by submitting a malformed connection string.

Vulnerability Details

CVE-ID: CVE-2020-37134

Affected Software: UltraVNC Viewer

Affected Versions: 1.2.4.0

Vulnerability: The application fails to properly throttle or limit resource allocation when processing input in the VNC Server connection dialog. By providing a 256-byte malformed payload, an unauthenticated user can trigger an application crash, resulting in a denial of service.

Business Impact

While the CVSS score of 7.5 indicates a high severity, the practical impact is limited to a denial of service on the specific machine running the viewer. A successful exploit disrupts remote administration capabilities, potentially hindering IT operations and causing temporary service outages for users reliant on remote access.

Remediation Plan

Immediate Action: Upgrade to a version of UltraVNC Viewer beyond 1.2.4.0 to resolve the underlying resource management flaw. If an update is not immediately feasible, restrict access to the VNC Viewer application to authorized personnel only.

Proactive Monitoring: Review system and application logs for repeated crash events or unusual connection attempts directed at the VNC Viewer interface.

Compensating Controls: Implement endpoint security policies that restrict the execution of remote access tools to hardened management workstations, reducing the attack surface.

Exploitation Status

Public Exploit Available: Yes, a proof of concept exists, as documented in the Exploit Database (EDB-ID: 48291).

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly straightforward to replicate, requiring only a simple string input into the connection dialog.

Analyst Recommendation

Organizations utilizing UltraVNC Viewer 1.2.4.0 should prioritize updating to a newer, patched release to eliminate this vulnerability. Given the ease of exploitation, maintaining outdated versions of remote access software poses an unnecessary risk to administrative continuity and infrastructure availability.

Description Summary:
UltraVNC Launcher 1.2.4.0 is susceptible to a stack-based buffer overflow in the Repeater Host configuration field, allowing local attackers to cause a denial of service via an overly long string.

Executive Summary:
A stack-based buffer overflow vulnerability in UltraVNC Launcher 1.2.4.0 allows local attackers to crash the application, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37133

Affected Software: UltraVNC Launcher

Affected Versions: 1.2.4.0

Vulnerability: The application fails to properly validate input length within the Repeater Host property field. By pasting a 300 character string into this field, an attacker with local access can trigger a stack-based buffer overflow, forcing the application to crash.

Business Impact

Successful exploitation of this vulnerability results in a denial of service condition for the UltraVNC Launcher application. While the impact is limited to local application availability, the resulting disruption can hinder administrative tasks or remote support operations. The CVSS score of 7.5 reflects the potential for service instability, although the requirement for local interaction limits the overall attack surface.

Remediation Plan

Immediate Action: There is currently no confirmed patch available for this specific issue. Users are advised to restrict physical or local access to systems running the vulnerable software to prevent unauthorized modification of application properties.

Proactive Monitoring: Security teams should monitor system logs for frequent application crashes or unexpected service termination events associated with the UltraVNC Launcher process.

Compensating Controls: Implement strict endpoint access controls and maintain updated antivirus or EDR solutions to detect and block unauthorized execution of malicious scripts or exploit attempts on the host system.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via ExploitDB (EDB-ID 48288).

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently straightforward to trigger, requiring only a simple input manipulation within the application interface.

Analyst Recommendation

Given that this vulnerability allows for an intentional service disruption, organizations should prioritize limiting local access to the UltraVNC configuration interface. Because no vendor patch is currently available, it is essential to employ compensating administrative controls to ensure only authorized personnel have the ability to modify application settings on sensitive endpoints.

Description Summary:
Nsauditor 3.2.0.0 is vulnerable to a buffer overflow in the registration name field, allowing local attackers to cause a denial of service via a specially crafted input string.

Executive Summary:
A buffer overflow vulnerability in Nsauditor 3.2.0.0 allows a local attacker to crash the application, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37130

Affected Software: Nsauditor Nsauditor

Affected Versions: 3.2.0.0

Vulnerability: This is a classic buffer overflow (CWE-120) triggered by providing an excessively long string of characters into the registration name input field. The flaw can be triggered by any local user without special privileges who has access to the application interface.

Business Impact

Successful exploitation results in the immediate termination of the Nsauditor application, leading to a denial of service. While the CVSS score of 7.5 indicates a high severity, the impact is limited to the availability of the auditing tool itself rather than unauthorized data access or remote code execution. However, an unexpected crash of security software can disrupt critical network monitoring and auditing workflows, potentially leaving gaps in security visibility.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict access to the Nsauditor interface to authorized personnel only to prevent malicious input from being processed.

Proactive Monitoring: Security teams should monitor system event logs for application crash reports or unexpected termination events associated with the Nsauditor process.

Compensating Controls: Ensure that the host operating system is hardened and that users are assigned the principle of least privilege to minimize the ability of unprivileged actors to interact with sensitive security software.

Exploitation Status

Public Exploit Available: Yes, a proof of concept exists on ExploitDB.

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit using a simple string of repeated characters, as documented in the public research write-up.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of triggering this denial of service, administrators should prioritize restricting access to the application. Until the vendor provides a formal update or patch to address the underlying buffer handling, limiting the execution environment to trusted users remains the most effective mitigation strategy.

Description Summary:
MEmu Play 7.1.3 contains an insecure folder permissions vulnerability allowing low-privileged users to replace the MemuService.exe file and gain SYSTEM-level privileges upon system restart.

Executive Summary:
MEmu Play 7.1.3 contains an insecure folder permissions flaw allowing low-privileged users to gain full SYSTEM-level access by replacing a critical service executable.

Vulnerability Details

CVE-ID: CVE-2020-37129

Affected Software: MEmu MEmu Play

Affected Versions: 7.1.3

Vulnerability: The application utilizes insecure file system permissions on its installation directory, specifically allowing low-privileged authenticated users to modify the MemuService.exe file. By replacing this executable with a malicious binary, an attacker can achieve local privilege escalation to SYSTEM level when the service restarts.

Business Impact

This vulnerability represents a significant internal threat, as it allows any user with basic access to the machine to gain total control over the operating system. Such an escalation can be used to disable security software, steal sensitive local data, or pivot further into the corporate network. The CVSS score of 9.8 underscores the critical impact of a local user gaining full administrative control.

Remediation Plan

Immediate Action: Update MEmu Play to the latest version, which addresses the directory permission issues, and verify that the "Everyone" or "Users" groups do not have write access to the installation folder.

Proactive Monitoring: Review system logs for unauthorized modifications to service executables and monitor for unexpected service restarts or new SYSTEM-level processes.

Compensating Controls: Utilize Endpoint Detection and Response (EDR) tools to block unauthorized file modifications in the Program Files directory and enforce the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, local privilege escalation vulnerabilities are frequently used by attackers after gaining an initial foothold in a network.

Analyst Recommendation

Organizations using MEmu Play must address this vulnerability immediately to prevent internal privilege escalation. We recommend auditing all third-party software installation directories for similar permission flaws. Applying the latest vendor patch is the most effective method to secure the service executable and maintain system integrity.

Description Summary:
Free Desktop Clock 3.0 contains a stack overflow vulnerability in the Time Zones display name input that allows unauthenticated attackers to overwrite SEH registers and execute arbitrary code.

Executive Summary:
Free Desktop Clock 3.0 is vulnerable to a critical stack overflow that allows unauthenticated attackers to execute arbitrary code via malicious Unicode input.

Vulnerability Details

CVE-ID: CVE-2020-37126

Affected Software: Free Desktop Clock Desktop Clock

Affected Versions: 3.0

Vulnerability: This vulnerability is a stack-based buffer overflow occurring within the Time Zones display name input field. An unauthenticated attacker can trigger this flaw by providing crafted Unicode input, leading to the overwriting of Structured Exception Handler (SEH) registers and subsequent arbitrary code execution.

Business Impact

A successful exploit allows for complete system compromise, as the attacker can gain the same execution privileges as the application. This could result in unauthorized data access, installation of malware, or total loss of system integrity. The CVSS score of 9.8 reflects the critical nature of this flaw due to the lack of required authentication and the potential for remote code execution.

Remediation Plan

Immediate Action: Administrators should immediately update Free Desktop Clock to the latest available version or decommission the software if it is no longer required for business operations.

Proactive Monitoring: Security teams should monitor for unusual application crashes or anomalous process behavior originating from the Desktop Clock executable.

Compensating Controls: Implement strict application whitelisting and ensure that users do not have administrative privileges, which can limit the scope of a successful code execution exploit.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of triggering stack overflows via input fields, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it allows for unauthenticated remote code execution. Organizations should prioritize the removal or update of Free Desktop Clock 3.0 immediately. Given the age of the software and the critical CVSS score, immediate remediation is the only effective way to mitigate the risk of full system takeover.

Description Summary:
An unauthenticated remote code execution vulnerability in the Edimax EW-7438RPn-v3 Mini allows attackers to execute arbitrary commands via the /goform/mp endpoint.

Executive Summary:
A critical unauthenticated remote code execution vulnerability in Edimax Wi-Fi extenders allows attackers to take full control of the device by sending crafted POST requests.

Vulnerability Details

CVE-ID: CVE-2020-37125

Affected Software: Edimax EW-7438RPn-v3 Mini

Affected Versions: 1.27

Vulnerability: The vulnerability is located in the /goform/mp web endpoint. It allows an unauthenticated attacker to perform command injection by sending a crafted POST request. This enables the attacker to download and execute malicious scripts directly on the device hardware.

Business Impact

Compromised Wi-Fi extenders can be used as persistent entry points into a corporate or home network. Attackers can perform man-in-the-middle attacks, sniff network traffic, or use the device as part of a botnet for DDoS attacks. The CVSS score of 9.8 reflects the ease of exploitation and the total compromise of the affected hardware.

Remediation Plan

Immediate Action: Update the firmware of the Edimax EW-7438RPn-v3 Mini to the latest version immediately. If the device is end-of-life, it should be replaced.

Proactive Monitoring: Monitor network traffic for unusual POST requests to the /goform/mp endpoint and watch for unauthorized outbound connections from IoT devices.

Compensating Controls: Place IoT devices like Wi-Fi extenders on a segregated VLAN with no access to sensitive internal resources or the management interfaces of other devices.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late disclosure of a 2020 vulnerability. Command injection in IoT devices is frequently targeted by automated malware like Mirai or its variants.

Analyst Recommendation

The ability for an unauthenticated attacker to execute commands remotely makes this a critical security risk. We recommend that organizations and individuals using these Edimax devices verify their firmware versions immediately. If a patch is not available from the vendor, the device should be decommissioned to prevent it from becoming a liability.

Description Summary:
A buffer overflow in the B64dec utility allows attackers to execute arbitrary code by overwriting the Structured Exception Handler (SEH) during the base64 decoding process.

Executive Summary:
A critical buffer overflow in the B64dec utility allows attackers to execute arbitrary code on a system by providing crafted input during base64 decoding operations.

Vulnerability Details

CVE-ID: CVE-2020-37124

Affected Software: B64dec Utility

Affected Versions: 1.1.2

Vulnerability: The vulnerability occurs during the base64 decoding process when the utility handles malformed or overly long input. An attacker can use an "egg hunter" technique and a crafted payload to overwrite the Structured Exception Handler (SEH), leading to arbitrary code execution when the exception is triggered.

Business Impact

If this utility is used as part of an automated pipeline or by system administrators, its compromise can lead to the execution of malicious code with the privileges of the executing user. This could result in data theft, malware installation, or persistent access to the host system. The CVSS score of 9.8 reflects the high risk of code execution.

Remediation Plan

Immediate Action: Discontinue use of B64dec version 1.1.2 and update to a patched version or switch to a standard, well-maintained decoding library (e.g., those built into modern operating systems).

Proactive Monitoring: Scan for the presence of the B64dec binary on systems and monitor for unexpected crashes or shells spawned by the utility.

Compensating Controls: Use sandboxing or containerization when running small utilities that process untrusted input to limit the potential impact of a compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This 2020 vulnerability was disclosed in 2026. The mention of an "egg hunter" technique suggests that the exploit is designed to work even in memory-constrained environments.

Analyst Recommendation

Small utilities like B64dec are often overlooked in security audits but can provide a critical foothold for attackers. We recommend replacing this utility with a more secure alternative immediately. If its use is mandatory, ensure it is updated and that it never processes data from untrusted sources without strict input validation.

Description Summary:
Pinger 1.0 contains a remote code execution vulnerability where unauthenticated attackers can inject shell commands into the ping and socket parameters of ping.php to execute system commands.

Executive Summary:
Pinger 1.0 is susceptible to a critical remote code execution vulnerability through unsanitized input in the ping and socket parameters, allowing full server takeover.

Vulnerability Details

CVE-ID: CVE-2020-37123

Affected Software: Pinger Pinger

Affected Versions: 1.0

Vulnerability: This is a command injection vulnerability located in the ping.php file. An unauthenticated remote attacker can exploit unsanitized input in the 'ping' and 'socket' parameters by appending shell metacharacters, allowing them to write arbitrary PHP files to the server and execute OS-level commands.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary commands on the web server, leading to a total compromise of the application and underlying data. This could result in the theft of sensitive information, website defacement, or the use of the server as a botnet node. The CVSS score of 9.8 highlights the extreme risk posed by unauthenticated remote code execution.

Remediation Plan

Immediate Action: Update the Pinger software to the latest version immediately or disable the ping.php script if it is not essential for business operations.

Proactive Monitoring: Inspect web server access logs for requests to ping.php containing suspicious characters such as semicolons, pipes, or backticks (e.g., ;, |, `).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell command injection patterns in HTTP GET and POST parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, command injection flaws in web-facing scripts are highly attractive targets for automated exploitation scripts.

Analyst Recommendation

This vulnerability represents a critical risk to any organization hosting the affected software. Immediate patching or removal of the vulnerable script is required. Developers should ensure that all user-supplied input is strictly validated against an allow-list and that system calls are made using secure APIs rather than direct shell execution.

Description Summary:
Nsauditor FTP Password Recover 2.4.8 is vulnerable to a stack-based buffer overflow that allows an attacker to cause a denial of service by crashing the application.

Executive Summary:
A stack-based buffer overflow in Nsauditor FTP Password Recover 2.4.8 allows an unauthenticated attacker to crash the application, resulting in a denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37122

Affected Software: Nsauditor FTP Password Recover

Affected Versions: 2.4.8

Vulnerability: The application fails to properly validate input length when processing registration codes, leading to a stack-based buffer overflow (CWE-121). An attacker can trigger this vulnerability by providing a crafted string of 1000 characters into the registration code input field, causing the process to terminate.

Business Impact

Successful exploitation results in a denial of service, which renders the application unusable and disrupts any associated file transfer or password recovery operations. While the CVSS score of 7.5 indicates a high severity, the impact is localized to the specific instance of the application running on an endpoint. This vulnerability poses a risk to operational continuity for users relying on this software for administrative tasks.

Remediation Plan

Immediate Action: As no official patch is available, users should restrict access to the application and avoid entering untrusted registration codes. Discontinuing use of the software is recommended if a secure alternative exists.

Proactive Monitoring: Security teams should monitor endpoint application logs for unexpected termination events or crash reports associated with the Nsauditor process.

Compensating Controls: Implement endpoint security policies that restrict the execution of unauthorized or legacy software to minimize the attack surface.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept script is available via Exploit-DB (EDB-ID: 48132).

Analyst Notes: As of February 8, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to trigger, as it requires only a simple string input to cause a crash.

Analyst Recommendation

Given the lack of a vendor-provided patch and the availability of a public proof-of-concept, users are advised to exercise caution and limit the use of this software in production environments. Organizations should prioritize migrating to a supported and actively maintained FTP utility to eliminate the risk posed by this unpatched buffer overflow.

Description Summary:
A buffer overflow in the Rubo DICOM Viewer server name input field allows attackers to overwrite the Structured Exception Handler (SEH) and execute arbitrary code.

Executive Summary:
A critical buffer overflow in Rubo DICOM Viewer allows attackers to execute arbitrary code remotely by exploiting an improperly handled input field in the DICOM server configuration.

Vulnerability Details

CVE-ID: CVE-2020-37120

Affected Software: Rubo DICOM Viewer

Affected Versions: 2.0

Vulnerability: The vulnerability exists in the DICOM server name input field. An attacker can provide a specially crafted string—potentially via a malicious configuration file or direct input—that overflows the buffer, overwrites the Structured Exception Handler (SEH), and redirects execution to an attacker-controlled payload.

Business Impact

In a medical environment, the compromise of a DICOM viewer can lead to the theft of Protected Health Information (PHI) or the manipulation of medical records. A successful exploit grants the attacker the same privileges as the user running the viewer, often leading to full workstation compromise. The CVSS score of 9.8 highlights the critical nature of this flaw.

Remediation Plan

Immediate Action: Update Rubo DICOM Viewer to the latest version. If the software is no longer supported, migrate to a secure, modern DICOM viewing solution.

Proactive Monitoring: Review system logs for application crashes related to the DICOM viewer and monitor for unauthorized network connections originating from medical imaging workstations.

Compensating Controls: Implement strict application whitelisting and restrict the ability of the viewer to process files from untrusted or external sources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This 2020 vulnerability was disclosed late in 2026. The use of SEH overwrite is a classic exploitation technique, suggesting that a functional exploit could be developed easily by motivated actors.

Analyst Recommendation

Healthcare organizations must prioritize the security of medical imaging software. We recommend an immediate audit of all workstations running Rubo DICOM Viewer 2.0. Given the sensitivity of medical data, the software should be updated or replaced immediately to prevent remote code execution and potential HIPAA violations.

Description Summary:
A buffer overflow in the Nsauditor DNS Lookup tool allows attackers to bypass ASLR and execute arbitrary shellcode via a crafted DNS query payload.

Executive Summary:
A critical buffer overflow vulnerability in Nsauditor allows remote attackers to execute arbitrary code and gain full control of the host system by exploiting the DNS Lookup tool.

Vulnerability Details

CVE-ID: CVE-2020-37119

Affected Software: Nsauditor

Affected Versions: 3.0.28, 3.2.1.0

Vulnerability: The DNS Lookup tool within Nsauditor fails to properly validate the size of incoming DNS query responses. This allows an attacker to send a malicious payload that triggers a three-byte overwrite, enabling them to bypass Address Space Layout Randomization (ASLR) and execute arbitrary shellcode.

Business Impact

Successful exploitation results in complete system compromise. Since Nsauditor is a security auditing tool often run with elevated privileges, an attacker gaining code execution could potentially compromise the entire network being audited. The CVSS score of 9.8 reflects the high probability of successful remote exploitation and total impact on confidentiality and integrity.

Remediation Plan

Immediate Action: Update Nsauditor to the latest available version. If a patch is unavailable, discontinue use of the DNS Lookup tool within the application.

Proactive Monitoring: Monitor for unusual outbound DNS traffic or crashes of the Nsauditor process, which may indicate failed exploitation attempts.

Compensating Controls: Use network-level DNS filtering and ensure that the host running Nsauditor is isolated from untrusted networks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: This is a late-disclosure vulnerability from 2020, published in 2026. While no active exploitation is currently reported, the technical details provided make the creation of an exploit highly feasible.

Analyst Recommendation

The delay in disclosure increases the risk that legacy systems remain vulnerable. We recommend that security teams immediately identify any installations of Nsauditor and apply updates. Because this tool is used for security auditing, its compromise would be particularly damaging to the organization's overall security posture.

Description Summary:
jizhiCMS 1.6.7 allows authenticated administrators to download arbitrary files via a file download vulnerability in the admin plugins update endpoint using crafted POST requests.

Executive Summary:
A file download vulnerability in jizhiCMS 1.6.7 allows authenticated administrators to perform unauthorized file operations, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2020-37117

Affected Software: jizhiCMS jizhiCMS

Affected Versions: 1.6.7

Vulnerability: The application contains a file download vulnerability within the admin plugins update endpoint. This flaw requires an attacker to possess administrative privileges to send crafted POST requests with malicious filepath and download_url parameters to trigger the unauthorized action.

Business Impact

Successful exploitation allows an authenticated administrator to download arbitrary files from the server, which can lead to sensitive information disclosure or the staging of further malicious payloads. With a CVSS score of 8.8, this vulnerability represents a high risk, as it facilitates the potential compromise of the underlying server environment and application configuration files.

Remediation Plan

Immediate Action: As no specific patch version is documented, administrators should restrict access to the administrative dashboard to trusted personnel only and monitor for any suspicious activity related to the /admin.php/Plugins/update.html endpoint.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the plugins update endpoint, particularly those involving unusual file paths or external URLs.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block POST requests to the plugins update endpoint that contain suspicious file path parameters or unauthorized external download sources.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 48361.

Analyst Notes: As of February 7, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user with administrative access to the CMS.

Analyst Recommendation

Given the high severity of this vulnerability, organizations currently utilizing jizhiCMS 1.6.7 must take immediate steps to secure the administrative interface. Because a public proof-of-concept exists, the potential for exploitation by malicious actors is elevated. It is strongly recommended to audit administrative accounts and apply strict network-level access controls to the management panel until a vendor-supplied security update is applied.

Description Summary:
GUnet OpenEclass 1 is affected by a critical security vulnerability that could lead to a complete system compromise or unauthorized data access.

Executive Summary:
A critical vulnerability in GUnet OpenEclass 1 poses a severe risk to the platform, potentially allowing unauthenticated attackers to gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2020-37116

Affected Software: GUnet OpenEclass

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects GUnet OpenEclass version 1. Similar to CVE-2020-37113, the CVSS score of 8.8 suggests a critical failure in input validation or access control, potentially allowing for remote code execution (RCE) by an unauthenticated user.

Business Impact

The impact of an 8.8 CVSS score vulnerability is catastrophic, potentially resulting in a total loss of confidentiality, integrity, and availability. Attackers could gain access to sensitive academic records, disrupt online learning, or use the server for malicious activities, leading to significant legal and reputational consequences.

Remediation Plan

Immediate Action: Update GUnet OpenEclass to the latest patched version immediately to remediate this critical security hole.

Proactive Monitoring: Implement robust logging and alerting for any attempts to access sensitive system files or execute shell commands through the web interface.

Compensating Controls: Ensure the web server is running with the least privilege necessary and that all software dependencies are up to date.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. The high severity indicates that if a technique is discovered, exploitation would likely be highly effective and damaging.

Analyst Recommendation

This vulnerability represents a critical risk to the organization. Immediate application of the vendor's security patch is mandatory to mitigate the threat of a full system takeover and to ensure the continued safety of user data.

Description Summary:
GUnet OpenEclass 1 is affected by a critical security vulnerability that could allow for unauthorized file access or remote code execution.

Executive Summary:
GUnet OpenEclass 1 contains a critical vulnerability that may allow an attacker to fully compromise the e-learning platform and its associated data.

Vulnerability Details

CVE-ID: CVE-2020-37113

Affected Software: GUnet OpenEclass

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability exists in GUnet OpenEclass version 1. The CVSS score of 8.8 indicates a critical flaw, likely involving an unauthenticated attacker's ability to perform arbitrary file operations or execute code on the server.

Business Impact

Successful exploitation could lead to the theft of student and educator data, the modification of educational content, and the use of the platform to distribute malware. A CVSS score of 8.8 justifies an extremely high severity rating, as it implies the attacker can achieve significant control over the system with minimal effort.

Remediation Plan

Immediate Action: Apply the latest security updates provided by GUnet for the OpenEclass platform immediately.

Proactive Monitoring: Monitor for suspicious file uploads or modifications within the web root and review system logs for unauthorized user creation.

Compensating Controls: Use a Web Application Firewall (WAF) to inspect all incoming traffic for malicious payloads and restrict file upload directories to prevent execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. However, the high CVSS score and the educational nature of the software make it an attractive target for data theft.

Analyst Recommendation

Given the critical CVSS score of 8.8, this vulnerability must be addressed with the highest priority. Immediate patching is the only reliable way to protect the platform from potential remote exploitation and data exfiltration.

Description Summary:
GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters.

Executive Summary:
The GUnet OpenEclass 1.7.3 e-learning platform is vulnerable to multiple SQL injection flaws that could allow an attacker to extract sensitive database information.

Vulnerability Details

CVE-ID: CVE-2020-37112

Affected Software: GUnet OpenEclass

Affected Versions: 1.7.3

Vulnerability: This vulnerability consists of multiple SQL injection flaws located in various modules, including the agenda module. An attacker with a low-privileged student account can exploit these unvalidated parameters to execute error-based or time-based SQL injection attacks to compromise database integrity.

Business Impact

Successful exploitation of these SQL injection vulnerabilities can lead to the unauthorized extraction of sensitive institutional data, including student records and administrative credentials. Given the CVSS score of 7.1, this is a high-severity issue that threatens the confidentiality of the e-learning platform and could facilitate further unauthorized access or total system compromise.

Remediation Plan

Immediate Action: Organizations must update to the latest available version of OpenEclass that includes patches for these SQL injection vulnerabilities. If an update is not immediately feasible, restrict access to the application and disable the vulnerable agenda and course work modules.

Proactive Monitoring: Security teams should review web server access logs for anomalous patterns, such as unexpected SQL syntax characters or high volumes of error-based responses originating from the agenda module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets to detect and block SQL injection patterns targeting the application parameters.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the Exploit-DB entry 48163.

Analyst Notes: As of February 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization across multiple application endpoints.

Analyst Recommendation

The presence of multiple SQL injection vectors in a widely used e-learning platform presents a significant risk to institutional data security. Administrators are strongly urged to apply the necessary vendor patches immediately. If the software is end-of-life or cannot be patched, it should be isolated from production networks to prevent unauthorized data access.

Description Summary:
A high-severity vulnerability exists in 60CycleCMS version 2 that could allow for unauthorized system compromise. Technical details suggest a significant flaw in the application's core logic.

Executive Summary:
60CycleCMS version 2 is affected by a high-severity vulnerability that poses a significant risk of unauthorized access and data compromise.

Vulnerability Details

CVE-ID: CVE-2020-37110

Affected Software: 60CycleCMS 60CycleCMS

Affected Versions: Version 2

Vulnerability: This vulnerability affects version 2 of the 60CycleCMS platform. While specific technical vectors are limited in initial disclosures, the high severity indicates a flaw likely accessible by an unauthenticated or low-privileged attacker targeting the CMS framework.

Business Impact

A successful exploit of this vulnerability could lead to a total compromise of the CMS environment, including the theft of sensitive data, unauthorized content modification, and potential lateral movement within the hosting infrastructure. The CVSS score of 8.2 reflects a High severity rating, highlighting the substantial risk to organizational integrity and availability of web services.

Remediation Plan

Immediate Action: Administrators should immediately apply the latest security patches provided by 60CycleCMS or upgrade to a supported, non-vulnerable version of the software.

Proactive Monitoring: Security teams should monitor web server access logs for unusual POST requests or directory traversal attempts targeting the CMS installation directory.

Compensating Controls: Implementing a Web Application Firewall (WAF) with generic CMS protection rules can help mitigate exploitation attempts until the primary patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, this is a late disclosure of a 2020 flaw; the potential for exploitation remains high as technical details become more widely known.

Analyst Recommendation

The high CVSS score of 8.2 necessitates immediate attention from security administrators. We strongly recommend prioritizing the patching of all 60CycleCMS v2 instances to prevent unauthorized access and potential data exfiltration.

Description Summary:
aSc TimeTables 2020.11.4 is susceptible to a denial of service vulnerability caused by a buffer overflow in the Subject title field.

Executive Summary:
A buffer overflow vulnerability in aSc TimeTables 2020.11.4 allows an attacker to crash the application, leading to a denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37109

Affected Software: aSc Applied Software Consultants aSc TimeTables

Affected Versions: 2020.11.4

Vulnerability: This is a classic buffer overflow (CWE-120) occurring when the application fails to validate the size of user-supplied input in the Subject title field. An attacker can trigger this condition by providing a 1000-character buffer, resulting in an application crash.

Business Impact

The exploitation of this vulnerability results in a denial of service, which disrupts the availability of the scheduling software. While the CVSS score of 7.5 indicates a high severity, the impact is primarily limited to application instability and service interruption rather than unauthorized data access. Such disruptions can cause significant operational delays for organizations relying on the software for critical logistical planning.

Remediation Plan

Immediate Action: Users should update to the latest available version of aSc TimeTables, as the vendor has addressed this flaw in subsequent releases.

Proactive Monitoring: Security teams should monitor system event logs for repeated application crashes or unexpected service termination events associated with the aSc TimeTables executable.

Compensating Controls: Ensure that access to the application is restricted to authorized personnel, as the attack vector requires local access or direct interaction with the software interface.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID 48133).

Analyst Notes: As of February 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to trigger by any user with access to the application interface.

Analyst Recommendation

The presence of a publicly available proof of concept elevates the risk of this denial of service vulnerability. Administrators are urged to verify their current version of aSc TimeTables and apply the latest security updates provided by aSc Applied Software Consultants to prevent intentional or accidental service disruption.