Description Summary:
PhpIX 2012 Professional contains a SQL injection vulnerability in the id parameter of product_detail.php that allows remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in PhpIX 2012 Professional allows remote attackers to manipulate database queries, potentially leading to unauthorized data extraction.

Vulnerability Details

CVE-ID: CVE-2020-37108

Affected Software: AllHandsMarketing PhpIX 2012 Professional

Affected Versions: 2012

Vulnerability: The application fails to properly sanitize user-supplied input within the id parameter of the product_detail.php script. This flaw allows an attacker with low privileges to inject malicious SQL commands into the backend database.

Business Impact

The ability to perform SQL injection poses a severe risk to the confidentiality and integrity of the application database. An attacker could potentially extract sensitive customer information, modify database records, or bypass authentication mechanisms. With a CVSS score of 7.1, this vulnerability is considered High, as it provides a direct path for attackers to compromise the underlying data layer.

Remediation Plan

Immediate Action: Since no official vendor patch is identified, administrators should restrict access to the affected script or implement input validation to sanitize the id parameter. If the software is no longer supported, migration to a modern, actively maintained alternative is strongly advised.

Proactive Monitoring: Security teams should monitor database logs for abnormal query structures, such as unexpected use of UNION or SLEEP commands, which are common indicators of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the id parameter in URI requests.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists via the Exploit Database (EDB-ID 48138).

Analyst Notes: As of February 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization on a publicly accessible parameter.

Analyst Recommendation

The presence of a publicly available exploit for this SQL injection vulnerability significantly increases the risk of successful compromise. Organizations currently running PhpIX 2012 Professional must prioritize the implementation of compensating controls, such as WAF rules, to sanitize traffic targeting the vulnerable parameter. Given the lack of a vendor-provided patch, decommissioning or isolating the application is the most effective way to eliminate this risk.

Description Summary:
Core FTP LE 2.2 contains a buffer overflow vulnerability that allows an attacker to trigger a denial of service by providing a specially crafted input string to the account field.

Executive Summary:
A buffer overflow vulnerability in Core FTP LE 2.2 allows an attacker to cause a permanent application crash, resulting in a denial of service that requires software reinstallation.

Vulnerability Details

CVE-ID: CVE-2020-37107

Affected Software: Core FTP LE

Affected Versions: 2.2 build 1947

Vulnerability: The application is susceptible to a classic buffer overflow (CWE-120) because it fails to perform bounds checking on the account input field. An attacker can crash the application by injecting a large buffer, specifically 20,000 repeated characters, into the account field during the connection configuration process.

Business Impact

Successful exploitation results in a persistent denial of service. Because the application fails to restart properly after the crash, the software must be manually uninstalled and reinstalled to restore functionality. This leads to operational downtime and potential loss of productivity for users relying on the application for file transfer tasks. While the CVSS score is 7.5, the impact is primarily availability focused.

Remediation Plan

Immediate Action: As there is no official patch available from the vendor, users should restrict access to the application and avoid entering untrusted or excessively long strings into the account configuration field.

Proactive Monitoring: Security teams should monitor system logs and endpoint stability for recurring application crashes or unexpected terminations of the Core FTP LE process.

Compensating Controls: Ensure the application is deployed within a secure environment where only authorized personnel can access the configuration settings to mitigate the risk of local exploitation.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists via the Exploit-DB entry (EDB-ID 48137).

Analyst Notes: As of February 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is triggered locally, requiring user interaction to paste the malicious payload into the configuration field.

Analyst Recommendation

Given the lack of a vendor-provided patch, users should consider migrating to a supported and actively maintained file transfer client to eliminate this risk. If the software must remain in use, enforce strict administrative controls over the local workstation to prevent unauthorized users from manipulating the vulnerable configuration parameters.

Description Summary:
PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands via the logid parameter.

Executive Summary:
A SQL injection vulnerability in PMB 5.6 allows authenticated attackers to execute arbitrary database commands, posing a significant risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2020-37105

Affected Software: PMB Services PMB

Affected Versions: 5.6 and earlier

Vulnerability: The application fails to properly sanitize the logid parameter within the /admin/sauvegarde/download.php script. This flaw allows an authenticated attacker to inject and execute arbitrary SQL commands against the underlying MySQL database.

Business Impact

Successful exploitation of this vulnerability allows an attacker to interact directly with the application database, potentially leading to unauthorized data exfiltration, modification, or destruction. Given the CVSS score of 7.1, this represents a high-severity risk that could compromise the entire Integrated Library Management System, resulting in significant operational disruption and loss of sensitive records.

Remediation Plan

Immediate Action: Upgrade to the latest version of PMB to ensure the SQL injection vulnerability is patched, as version 5.6 and earlier are confirmed vulnerable.

Proactive Monitoring: Monitor web server access logs for requests directed at /admin/sauvegarde/download.php that contain unexpected characters or SQL syntax in the logid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP request parameters.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept is documented in the Exploit-DB entry 48356.

Analyst Notes: As of February 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability requires the attacker to possess valid authentication credentials to reach the vulnerable administrative endpoint.

Analyst Recommendation

Organizations utilizing PMB must prioritize patching to remediate this SQL injection flaw. Because the vulnerability is reachable by authenticated users, it is critical to enforce the principle of least privilege for all administrative accounts to limit the potential blast radius of a compromised session while the update is being prepared and deployed.

Description Summary:
ASTPP 4.0.1 allows unauthenticated attackers to download database backups by predicting filename patterns containing a 6-digit PIN, potentially exposing sensitive database contents.

Executive Summary:
A critical information disclosure vulnerability in ASTPP 4.0.1 allows unauthenticated attackers to exfiltrate database backups through predictable filename patterns.

Vulnerability Details

CVE-ID: CVE-2020-37104

Affected Software: iNextrix ASTPP

Affected Versions: 4.0.1

Vulnerability: This vulnerability is an information disclosure flaw (CWE-538) where the software generates database backup files with predictable naming conventions in a publicly accessible directory. An unauthenticated attacker can use fuzzing techniques to guess the filename and download the full database dump.

Business Impact

The successful exploitation of this vulnerability leads to the complete compromise of the database, which contains sensitive billing, user, and configuration information. Given the CVSS score of 7.5, this high-severity flaw poses a severe risk of data exfiltration and potential identity theft, potentially leading to significant reputational damage and regulatory non-compliance for organizations using this platform.

Remediation Plan

Immediate Action: Upgrade to a patched version of ASTPP if available or restrict access to the /database_backup/ directory via server-level configuration to prevent unauthorized downloads.

Proactive Monitoring: Review web server access logs for repeated requests to the /database_backup/ directory, particularly those originating from unknown or suspicious IP addresses that follow a fuzzing pattern.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block direct access to files within the /database_backup/ directory for all users, requiring authentication or specific administrative access.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the Exploit-DB entry 47900.

Analyst Notes: As of February 13, 2026, there is no confirmed active exploitation in the wild; however, a published exploit exists in the form of a technical write-up and proof-of-concept on Exploit-DB, making the risk of exploitation credible. The vulnerability is highly exploitable due to the simplicity of the filename prediction and the lack of authentication required to access the files.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high risk of sensitive data exposure, organizations must treat this vulnerability with high priority. Administrators should immediately restrict access to the affected directory via web server configurations to mitigate the risk of unauthorized exfiltration while evaluating the feasibility of upgrading the software to a secure version.

Description Summary:
A high-severity vulnerability in Adaware Web Companion 4 could allow for unauthorized privilege escalation or system interference on the local machine.

Executive Summary:
Adaware Web Companion 4 is affected by a high-severity vulnerability that could allow an attacker to compromise the security of the host system.

Vulnerability Details

CVE-ID: CVE-2020-37102

Affected Software: Adaware Web Companion

Affected Versions: 4

Vulnerability: This vulnerability exists in Adaware Web Companion 4. Given the CVSS score of 7.8, it likely involves a flaw in the software's service or update mechanism that could be exploited by a local attacker to escalate privileges or bypass security features.

Business Impact

A successful exploit could allow an attacker to disable security protections on an endpoint or gain administrative control over the local system. This increases the risk of malware infection and data theft on employee workstations.

Remediation Plan

Immediate Action: Uninstall Adaware Web Companion 4 or update it to the latest version provided by the vendor.

Proactive Monitoring: Use endpoint detection and response (EDR) tools to monitor for unusual process behavior originating from security software components.

Compensating Controls: Implement the principle of least privilege on all workstations to limit the potential for local privilege escalation attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Security software vulnerabilities are often targeted to blind other security controls on a system.

Analyst Recommendation

We recommend that IT administrators identify and update or remove Adaware Web Companion 4 from all managed endpoints. Ensuring that endpoint security tools are themselves secure is a fundamental requirement for a robust defense-in-depth strategy.

Description Summary:
VPN Unlimited 6 is affected by a high-severity vulnerability that could compromise the security of encrypted tunnels or lead to local privilege escalation.

Executive Summary:
VPN Unlimited 6 contains a high-severity vulnerability that threatens the privacy and security of the user's encrypted communications.

Vulnerability Details

CVE-ID: CVE-2020-37101

Affected Software: KeepSolid VPN Unlimited 6

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability in VPN Unlimited 6 likely involves a flaw in how the application handles system-level privileges or manages secure connections. With a CVSS score of 7.8, it represents a significant risk where an attacker could potentially intercept traffic or gain unauthorized access on the local machine.

Business Impact

For organizations relying on VPNs to secure remote work, this flaw is critical. A compromise could lead to the exposure of sensitive corporate data being transmitted over the VPN or allow an attacker to bypass internal security perimeters. The 7.8 CVSS score indicates a high impact on the confidentiality of business communications.

Remediation Plan

Immediate Action: Update VPN Unlimited to the latest available version to ensure all security patches are applied.

Proactive Monitoring: Review endpoint security logs for any unauthorized attempts to modify VPN configuration files or unexpected behavior from the VPN client service.

Compensating Controls: Ensure that all remote access requires Multi-Factor Authentication (MFA) and that endpoints are protected by updated EDR/AV solutions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. As a late-disclosure vulnerability, it is essential to ensure no legacy clients remain in use within the organization.

Analyst Recommendation

The security of the VPN tunnel is the cornerstone of remote work safety. Given the 7.8 CVSS score, administrators must ensure all users have updated their VPN Unlimited software to a supported version immediately to prevent potential data interception or privilege escalation.

Description Summary:
A high-severity vulnerability in Sync Breeze Enterprise 12 could allow for unauthorized file synchronization or system access.

Executive Summary:
Sync Breeze Enterprise 12 contains a high-severity vulnerability that could allow an attacker to manipulate file synchronization tasks and compromise data.

Vulnerability Details

CVE-ID: CVE-2020-37100

Affected Software: Sync Breeze Enterprise

Affected Versions: 12

Vulnerability: This vulnerability is present in Sync Breeze Enterprise 12. With a CVSS score of 7.8, the flaw likely permits an attacker to interfere with synchronization processes or gain unauthorized access to the management server, potentially through the web-based interface.

Business Impact

Exploitation of this vulnerability could result in the unauthorized copying of sensitive data to external locations or the corruption of synchronized files. This poses a direct threat to data integrity and confidentiality across the enterprise.

Remediation Plan

Immediate Action: Update Sync Breeze Enterprise 12 to the latest patched version provided by the vendor immediately.

Proactive Monitoring: Monitor synchronization logs for any new or modified tasks that were not initiated by authorized administrators.

Compensating Controls: Disable the web management interface if it is not required, or restrict its access to a dedicated management network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. The nature of synchronization software makes it a high-value target for data exfiltration.

Analyst Recommendation

It is critical to apply the available patches for Sync Breeze Enterprise 12 immediately. Organizations should ensure that all file synchronization tools are properly secured to prevent unauthorized data movement and maintain system integrity.

Description Summary:
A high-severity vulnerability in Disk Savvy Enterprise 12 could allow attackers to gain unauthorized access to disk space analysis data or the host system.

Executive Summary:
Disk Savvy Enterprise 12 is vulnerable to a high-severity security flaw that could lead to unauthorized access and system compromise.

Vulnerability Details

CVE-ID: CVE-2020-37099

Affected Software: Disk Savvy Enterprise

Affected Versions: 12

Vulnerability: This vulnerability affects Disk Savvy Enterprise 12. The CVSS score of 7.8 suggests a significant flaw in the application's handling of requests or permissions, potentially allowing an attacker to bypass security controls in the management console.

Business Impact

An attacker could exploit this flaw to view sensitive file system information or disrupt disk management operations. This could lead to the exposure of confidential data locations and facilitate further attacks against the organization's storage infrastructure.

Remediation Plan

Immediate Action: Apply the vendor's security update for Disk Savvy Enterprise 12 immediately.

Proactive Monitoring: Audit the system for any unauthorized changes to disk analysis reports or configuration settings within the Disk Savvy environment.

Compensating Controls: Use network segmentation to isolate the disk management server and ensure that all administrative traffic is encrypted and authenticated.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. Like other Flexense products in this batch, the late disclosure warrants a thorough review of existing installations.

Analyst Recommendation

Immediate patching is advised to mitigate the risks associated with this high-severity vulnerability. Protecting disk management tools is essential for maintaining the overall security and confidentiality of the enterprise file system.

Description Summary:
A high-severity vulnerability in Disk Sorter Enterprise 12 could allow for unauthorized administrative actions or system compromise.

Executive Summary:
Disk Sorter Enterprise 12 contains a high-severity security flaw that could allow an attacker to compromise the host system's data integrity.

Vulnerability Details

CVE-ID: CVE-2020-37098

Affected Software: Disk Sorter Enterprise

Affected Versions: 12

Vulnerability: This vulnerability resides in the Disk Sorter Enterprise 12 management interface or core service. With a CVSS score of 7.8, it likely involves a flaw that allows an authenticated or unauthenticated attacker to execute unauthorized commands or access sensitive file system metadata.

Business Impact

Successful exploitation could lead to unauthorized file manipulation, data loss, or the exposure of file system structures across the enterprise. This poses a significant risk to organizational data management and could be used as a stepping stone for further network infiltration.

Remediation Plan

Immediate Action: Upgrade Disk Sorter Enterprise to the latest version immediately to address this vulnerability.

Proactive Monitoring: Monitor for unusual service restarts or administrative logins to the Disk Sorter web interface from unrecognized IP addresses.

Compensating Controls: Restrict access to the Disk Sorter management ports (typically TCP 8080) to authorized administrative workstations only via host-based firewalls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late disclosure highlights the need to audit legacy enterprise software for unpatched vulnerabilities.

Analyst Recommendation

We recommend an immediate update of Disk Sorter Enterprise 12. Maintaining up-to-date enterprise management software is critical for preventing unauthorized access to the underlying storage infrastructure.

Description Summary:
A security vulnerability exists in the Edimax EW-7438RPn range extender that could allow for unauthorized access or system compromise.

Executive Summary:
The Edimax EW-7438RPn range extender contains a high-severity vulnerability that could allow an attacker to compromise the device and intercept network traffic.

Vulnerability Details

CVE-ID: CVE-2020-37097

Affected Software: Edimax EW-7438RPn

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects the Edimax EW-7438RPn hardware. While technical specifics are limited in the late disclosure, the high CVSS score suggests a critical failure in the device's management interface or network stack, likely exploitable by an unauthenticated attacker on the local network.

Business Impact

A successful exploit of this range extender could lead to a complete compromise of the local network infrastructure. Attackers could perform man-in-the-middle (MitM) attacks, redirecting or capturing sensitive data transmitted by connected users. With a CVSS score of 7.5, the risk to confidentiality and integrity is significant, potentially leading to the exposure of corporate credentials or internal communications.

Remediation Plan

Immediate Action: Administrators should immediately check for and apply the latest firmware updates from the Edimax support portal to mitigate this flaw.

Proactive Monitoring: Monitor network traffic originating from IoT and networking hardware for unusual outbound connections or unauthorized configuration changes.

Compensating Controls: Isolate range extenders and similar networking hardware on a dedicated management VLAN with strict access control lists (ACLs) to prevent lateral movement.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its late disclosure, the potential for exploitation remains a high priority for organizations using legacy networking hardware.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate remediation. Organizations should prioritize updating the firmware on all Edimax EW-7438RPn devices or consider replacing end-of-life hardware that no longer receives security patches to maintain a robust security posture.

Description Summary:
Buffer overflow in Cyberoam Authentication Client 2.1.2.7 allows remote attackers to execute arbitrary code by overwriting SEH memory via a crafted server address.

Executive Summary:
A critical buffer overflow in the Cyberoam Authentication Client enables remote attackers to gain system-level access by overwriting memory via a crafted server address.

Vulnerability Details

CVE-ID: CVE-2020-37095

Affected Software: Cyberoam Authentication Client

Affected Versions: 2.1.2.7

Vulnerability: This is a stack-based buffer overflow vulnerability triggered by malicious input in the "Cyberoam Server Address" field. An unauthenticated remote attacker can provide a specially crafted string that overwrites the Structured Exception Handler (SEH), leading to the execution of arbitrary code and the establishment of a bind TCP shell on port 1337.

Business Impact

The impact of this vulnerability is severe, as it allows for complete system takeover with system-level privileges. With a CVSS score of 9.8, the flaw poses a significant risk of data exfiltration and persistent unauthorized access to corporate endpoints.

Remediation Plan

Immediate Action: Update all Cyberoam Authentication Client installations to the latest available version provided by the vendor.

Proactive Monitoring: Monitor network traffic for unauthorized connections on TCP port 1337 and audit endpoint logs for suspicious memory corruption events.

Compensating Controls: Restrict access to the authentication client's input fields through group policies and deploy Endpoint Detection and Response (EDR) solutions to block shellcode execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 7, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure of a legacy issue, but the high CVSS score necessitates immediate remediation for any remaining legacy deployments.

Analyst Recommendation

Given the ability to achieve a system-level bind shell, this vulnerability represents a maximum-severity risk. Organizations must prioritize the removal or update of version 2.1.2.7 across all workstations to prevent remote exploitation.

Description Summary:
EspoCRM 5.8.5 is vulnerable to an authentication bypass via manipulation of authorization headers, allowing unauthorized access to administrative user information and privileges.

Executive Summary:
A critical authentication vulnerability in EspoCRM 5.8.5 allows unauthenticated attackers to hijack user accounts and escalate privileges to administrative levels.

Vulnerability Details

CVE-ID: CVE-2020-37094

Affected Software: EspoCRM

Affected Versions: 5.8.5

Vulnerability: This vulnerability involves the improper handling of Basic Authorization and Espo-Authorization tokens. Attackers can decode and modify these headers to bypass authentication mechanisms and impersonate other users, including administrators.

Business Impact

The ability for an attacker to gain unauthorized administrative access poses a severe threat to data integrity, confidentiality, and system availability. Given the CVSS score of 9.8, this vulnerability could lead to total system compromise, theft of sensitive customer data, and unauthorized modification of business records.

Remediation Plan

Immediate Action: Upgrade to the latest available version of EspoCRM provided by the vendor to remediate the header manipulation flaw.

Proactive Monitoring: Review application access logs for anomalous authorization header patterns or unauthorized access attempts to administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate authorization headers for malformed or suspicious token strings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk that requires immediate attention. Organizations utilizing EspoCRM 5.8.5 should prioritize patching to the latest version to prevent unauthorized administrative access and potential data exfiltration.

Description Summary:
A vulnerability in the Netis E1+ 1 range extender could allow for unauthorized device manipulation. This flaw is distinct from other reported issues for the same product line and affects core firmware components.

Executive Summary:
A high-severity vulnerability in the Netis E1+ 1 device could permit an attacker to take control of the networking hardware, leading to a compromise of the local network environment.

Vulnerability Details

CVE-ID: CVE-2020-37093

Affected Software: Netis E1+

Affected Versions: See vendor advisory

Vulnerability: This vulnerability affects the Netis E1+ 1. Similar to other flaws in this product line, it likely stems from improper input validation or insecure default configurations in the firmware, which could be exploited by an unauthenticated attacker with network access to the device.

Business Impact

The impact of a compromised network extender includes the potential for man-in-the-middle (MitM) attacks, data theft, and the loss of network availability. A CVSS score of 7.5 highlights the High severity of this risk, as it directly undermines the security perimeter of the organization's physical network infrastructure.

Remediation Plan

Immediate Action: Immediately update the Netis E1+ firmware to the most recent version provided by the manufacturer.

Proactive Monitoring: Perform regular audits of network device logs and monitor for unexpected firmware modifications or configuration changes.

Compensating Controls: Isolate IoT and network infrastructure devices on a separate VLAN to limit the potential impact of a device compromise on the primary corporate network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late-disclosed vulnerability (originally from 2020) emphasizes the ongoing risk posed by legacy networking hardware that may not be regularly audited for security.

Analyst Recommendation

It is critical to apply the necessary firmware updates immediately. Given the High CVSS score, any delay in remediation could leave the network vulnerable to attackers seeking to exploit unpatched infrastructure for data exfiltration or as a platform for further attacks.

Description Summary:
A security vulnerability has been identified in the Netis E1+ version 1 range extender. This flaw resides in the device's firmware and could allow for unauthorized access to the network device.

Executive Summary:
The Netis E1+ range extender (Version 1) contains a high-severity vulnerability that could allow an attacker to compromise the device and gain unauthorized access to the local network.

Vulnerability Details

CVE-ID: CVE-2020-37092

Affected Software: Netis E1+

Affected Versions: Version 1

Vulnerability: This vulnerability affects the firmware of the Netis E1+ version 1. It likely involves a flaw in the web management interface or the device's handling of network requests, potentially allowing an unauthenticated attacker to gain administrative control over the range extender.

Business Impact

A compromised range extender can serve as a persistent foothold for an attacker within a network, allowing for traffic interception and lateral movement. With a CVSS score of 7.5, this High severity vulnerability poses a significant risk to network privacy and the security of all devices connected through the extender.

Remediation Plan

Immediate Action: Apply the latest firmware updates from Netis for the E1+ device. If the device has reached end-of-life (EOL), it should be replaced with a currently supported model.

Proactive Monitoring: Check for unauthorized changes to the device's configuration, such as modified DNS settings or unknown administrative accounts.

Compensating Controls: Disable remote management of the device from the WAN side and ensure the local management interface is protected by a strong, unique password.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. However, networking equipment is frequently targeted by botnets and state-sponsored actors for long-term surveillance and network disruption.

Analyst Recommendation

The High CVSS score and the potential for network-wide impact make this a critical issue. Administrators must ensure that all Netis E1+ devices are updated or decommissioned if patches are unavailable to prevent them from being used as entry points for attackers.

Description Summary:
School ERP Pro 1.0 contains an unrestricted file upload vulnerability in its messaging system, allowing attackers to execute arbitrary PHP code on the server.

Executive Summary:
An arbitrary file upload vulnerability in School ERP Pro 1.0 enables remote attackers to achieve remote code execution (RCE) by uploading malicious PHP scripts.

Vulnerability Details

CVE-ID: CVE-2020-37090

Affected Software: School ERP Pro

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize or restrict file types uploaded via the messaging system's attachment feature. This allows an attacker to upload executable PHP files, which can then be triggered to execute arbitrary code within the server environment.

Business Impact

With a CVSS score of 9.8, this flaw allows for complete server compromise. Successful exploitation grants attackers the ability to execute commands with the privileges of the web server, leading to potential ransomware deployment, data theft, and full control over the application's underlying infrastructure.

Remediation Plan

Immediate Action: Update to the latest version of School ERP Pro to ensure that file upload validation mechanisms are correctly implemented.

Proactive Monitoring: Monitor server directories where uploads are stored for suspicious files or unexpected script execution attempts.

Compensating Controls: Implement strict server-side file type validation and restrict the execution of scripts within the upload directory via web server configuration settings (e.g., .htaccess or Nginx location blocks).

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote Code Execution (RCE) vulnerabilities are of the highest severity. Administrators must update School ERP Pro immediately and audit the system for any signs of existing unauthorized file uploads or persistent backdoors.

Description Summary:
A high-severity vulnerability in School ERP Pro 1 could allow unauthorized access to sensitive educational and personal data.

Executive Summary:
School ERP Pro version 1 is affected by a high-severity vulnerability that poses a significant risk to the confidentiality of student and staff records.

Vulnerability Details

CVE-ID: CVE-2020-37089

Affected Software: School ERP Pro

Affected Versions: 1

Vulnerability: This vulnerability affects the School ERP Pro 1 platform. Given the CVSS score of 8.2, it likely involves a flaw that allows an attacker to bypass authentication or escalate privileges to access sensitive database records containing personal identifiable information (PII).

Business Impact

The impact of this vulnerability is severe, potentially leading to the exposure of student records, financial data, and staff information. Such a breach could result in legal liabilities, regulatory fines (e.g., GDPR or FERPA), and irreparable reputational damage to the educational institution.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor for School ERP Pro 1 immediately.

Proactive Monitoring: Review database access logs for any unauthorized queries or bulk exports of student and personnel data.

Compensating Controls: Ensure the ERP system is not directly exposed to the public internet and require Multi-Factor Authentication (MFA) for all user accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This is a late-disclosure vulnerability, meaning legacy systems are at heightened risk if they have not been maintained.

Analyst Recommendation

Educational institutions using School ERP Pro 1 must act urgently to secure their systems. Applying the vendor's patch is the only definitive way to protect sensitive data from unauthorized access and potential exploitation.

Description Summary:
School ERP Pro 1 is vulnerable to a high-severity security flaw that could lead to unauthorized access to sensitive educational and administrative data.

Executive Summary:
School ERP Pro 1 is affected by a high-severity vulnerability that risks the exposure of sensitive student and administrative information.

Vulnerability Details

CVE-ID: CVE-2020-37088

Affected Software: School ERP Pro School ERP Pro 1

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability in School ERP Pro 1 represents a significant security gap in the application’s logic or data handling. With a CVSS score of 7.5, it likely permits an attacker—potentially unauthenticated depending on the deployment—to access or manipulate sensitive records within the ERP system.

Business Impact

The impact of a successful exploit is severe, involving the potential leak of Personally Identifiable Information (PII) of students and staff. Such a breach could result in regulatory non-compliance, legal liabilities, and irreparable damage to the institution's reputation. The 7.5 CVSS score highlights a high risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Apply all available security patches for School ERP Pro 1 or migrate to a more recent, supported version of the software.

Proactive Monitoring: Audit database access logs for unusual queries and monitor for bulk data exports that could indicate an active breach.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious traffic and restrict access to the ERP interface to internal networks or via a secure VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure, but the sensitivity of the data managed by ERP systems makes this a high-priority fix for educational institutions.

Analyst Recommendation

The protection of student data is paramount, and the 7.5 CVSS score indicates a serious flaw that must be addressed. Administrators should apply vendor patches immediately and ensure that the application is not exposed directly to the public internet without robust security layers.

Description Summary:
VirtualTablet Server 3 contains a security vulnerability that could be exploited to perform unauthorized actions on the host system. This affects the server component responsible for receiving input from remote devices.

Executive Summary:
A high-severity vulnerability in VirtualTablet Server 3 could allow an attacker to compromise the host system by exploiting the communication channel between the server and remote tablet devices.

Vulnerability Details

CVE-ID: CVE-2020-37085

Affected Software: VirtualTablet VirtualTablet Server

Affected Versions: Version 3

Vulnerability: This vulnerability affects the VirtualTablet Server 3 application. Given its function as a network-based input server, the flaw likely involves improper validation of data received from unauthenticated remote clients, potentially leading to unauthorized command execution or service disruption.

Business Impact

A successful exploit could allow an attacker to gain control over the host machine or disrupt the input services required for creative work. The CVSS score of 7.5 reflects a High severity risk, particularly in environments where these servers are exposed to the network, potentially leading to broader lateral movement within the organization.

Remediation Plan

Immediate Action: Update VirtualTablet Server to the latest version immediately. If the software is no longer supported, consider migrating to a secure alternative.

Proactive Monitoring: Monitor for unexpected network traffic on the ports used by VirtualTablet Server and check for unauthorized processes running with the server's privileges.

Compensating Controls: Use a host-based firewall to restrict access to the VirtualTablet Server port to only known, authorized client IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This is a late disclosure for a 2020 vulnerability, which may indicate that researchers have recently found a way to weaponize the flaw in legacy environments.

Analyst Recommendation

Organizations using VirtualTablet Server 3 should treat this as a high-priority patch. The potential for unauthorized network-based access to a host system via an input driver is a significant security risk that must be addressed through immediate updates and network isolation.

Description Summary:
PHP AddressBook 9 is vulnerable to a high-severity security flaw that could allow for unauthorized data access or system manipulation.

Executive Summary:
PHP AddressBook 9 contains a high-severity vulnerability that could lead to the exposure of sensitive contact information and compromise of the application server.

Vulnerability Details

CVE-ID: CVE-2020-37083

Affected Software: PHP AddressBook PHP AddressBook

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects PHP AddressBook version 9. With a CVSS score of 8.2, it likely involves a critical flaw such as SQL injection or a broken authentication mechanism that allows an unauthenticated attacker to access or modify the address book database.

Business Impact

The compromise of an address book application leads directly to the loss of Confidentiality, Integrity, and Availability (CIA) for contact data. This information is often used for phishing or social engineering attacks against employees. The high CVSS score reflects the significant risk of data exfiltration and potential administrative takeover.

Remediation Plan

Immediate Action: Immediately update PHP AddressBook to the latest secure version or disable the application if it is no longer required for business operations.

Proactive Monitoring: Review database logs for unusual query patterns and monitor for unauthorized administrative logins.

Compensating Controls: Place the application behind a VPN or use strict IP-based access controls to limit exposure to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late disclosure highlights a long-standing risk that should be remediated before public exploit code is developed.

Analyst Recommendation

The CVSS score of 8.2 indicates a high level of urgency. Security administrators must prioritize patching this application or migrating to a more modern, secure contact management solution to prevent data loss.

Description Summary:
An unauthenticated file access vulnerability in webERP 4.15.1 allows remote attackers to download database backup files directly from the web directory.

Executive Summary:
webERP 4.15.1 is vulnerable to a critical data exposure flaw that allows unauthenticated attackers to download entire database backups, compromising all corporate financial and operational data.

Vulnerability Details

CVE-ID: CVE-2020-37082

Affected Software: webERP

Affected Versions: 4.15.1

Vulnerability: The application stores database backups in a predictable web-accessible directory (companies/weberp/) without proper access controls. An unauthenticated attacker can download these files by guessing or discovering the timestamp-based filename.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a total loss of confidentiality. Since webERP manages sensitive business data, including financials, customer lists, and inventory, the exposure of a full SQL backup allows an attacker to replicate the entire business database offline for malicious use.

Remediation Plan

Immediate Action: Update webERP to the latest version and move all backup directories outside of the web server's document root immediately.

Proactive Monitoring: Check web server access logs for requests to the companies/weberp/ directory and any files ending in .sql.gz.

Compensating Controls: Use .htaccess or server configuration files to deny all web access to the backup directories and implement strong authentication for any directory containing sensitive exports.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. However, the predictable nature of the backup filenames makes this a trivial vulnerability to exploit once the directory structure is known.

Analyst Recommendation

Immediate isolation of backup files is required. Administrators must ensure that no sensitive data, especially database backups, is ever stored in a location reachable by a web browser without robust authentication and authorization checks.

Description Summary:
Fishing Reservation System 7.5 is vulnerable to multiple remote SQL injection flaws in admin.php, cart.php, and calendar.php, allowing unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in Fishing Reservation System 7.5 allows remote, unauthenticated attackers to compromise the underlying database and web application.

Vulnerability Details

CVE-ID: CVE-2020-37081

Affected Software: Fishing Reservation System

Affected Versions: 7.5

Vulnerability: This vulnerability is a classic SQL injection (CWE-89) affecting multiple parameters, including uid, pid, type, m, y, and code. The application fails to properly neutralize user input, allowing attackers with guest access or low privileges to execute malicious SQL statements.

Business Impact

Successful exploitation grants an attacker the ability to interact directly with the backend database, potentially leading to unauthorized data extraction, modification, or complete system takeover. Given the CVSS score of 7.1, this vulnerability poses a significant risk to the confidentiality and integrity of reservation data and customer information, which could lead to severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As there is no official patch available, administrators should restrict public access to the affected files (admin.php, cart.php, and calendar.php) or disable the application until a fix is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax, such as "union select" or "--" sequences, targeting the identified parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious input patterns targeting the vulnerable parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the Vulnerability Laboratory research write-up and ExploitDB entry 48417.

Analyst Notes: As of February 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required user interaction and the ease of crafting malicious GET requests.

Analyst Recommendation

Given the availability of public proof-of-concept exploit code, the risk of exploitation is high. Organizations currently running Fishing Reservation System 7.5 must prioritize the implementation of compensating controls, such as WAF rules or network-level access restrictions, to protect the application while awaiting a vendor-supplied patch.

Description Summary:
webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php component, allowing attackers to delete arbitrary files on the server.

Executive Summary:
A file deletion vulnerability in the webTareas 2.0.p8 administration component allows attackers to delete critical system files, potentially leading to denial-of-service or system instability.

Vulnerability Details

CVE-ID: CVE-2020-37080

Affected Software: webTareas

Affected Versions: 2.0.p8

Vulnerability: The 'print_layout.php' component fails to properly validate the 'atttmp1' parameter, allowing an attacker to traverse directories and delete arbitrary files. While the description notes the requirement for authentication, it also highlights an unauthenticated file deletion mechanism, indicating a severe flaw in access control.

Business Impact

The ability to delete arbitrary files on the server can result in a complete Denial of Service (DoS) by removing critical configuration or system files. With a CVSS score of 9.8, the potential for catastrophic system failure and data loss is extreme, necessitating urgent remediation.

Remediation Plan

Immediate Action: Update webTareas to the latest version to patch the file deletion logic in the administration component.

Proactive Monitoring: Monitor filesystem integrity and log file deletion events, specifically looking for unauthorized access to the 'print_layout.php' component.

Compensating Controls: Restrict access to the administration interface to trusted IP addresses and ensure the application runs with the minimum necessary filesystem permissions to limit the impact of potential deletions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability poses a severe risk to system stability. Administrators should apply the vendor-provided patch immediately and review access control configurations to ensure that only authorized personnel can interact with administrative components.

Description Summary:
A high-severity vulnerability in i-doit Open Source CMDB 1 allows for potential unauthorized access or manipulation of configuration management data within the application environment.

Executive Summary:
i-doit Open Source CMDB version 1 contains a high-severity vulnerability that could allow an attacker to compromise sensitive IT infrastructure data.

Vulnerability Details

CVE-ID: CVE-2020-37078

Affected Software: i-doit Open Source CMDB

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability involves a flaw in the i-doit Open Source CMDB 1 platform. While the description is concise, the CVSS score indicates a significant risk, likely involving an unauthenticated or low-privileged attacker gaining unauthorized access to the configuration management database.

Business Impact

A successful exploit could lead to the total exposure of an organization's IT asset landscape, including server configurations, network topologies, and sensitive credentials. Given the CVSS score of 8.8, this vulnerability poses a high risk to data confidentiality and integrity, potentially enabling further lateral movement within the corporate network.

Remediation Plan

Immediate Action: Administrators should immediately upgrade i-doit instances to the latest patched version provided by the vendor to mitigate unauthorized access risks.

Proactive Monitoring: Security teams should review application access logs for unusual administrative activity or bulk data exports originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common exploit patterns targeting CMDB software and restrict access to the management interface via VPN or IP whitelisting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score and the late disclosure nature of this entry, the potential for exploitation remains a significant concern for legacy installations.

Analyst Recommendation

The high severity of this flaw necessitates immediate attention from IT infrastructure teams. We recommend applying the vendor's security updates without delay to prevent the exposure of critical asset management data.

Description Summary:
Victor CMS version 1 is susceptible to a high-severity security flaw that could allow an attacker to gain unauthorized control over the application.

Executive Summary:
Victor CMS version 1 is vulnerable to a high-risk exploit that could lead to full system compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2020-37076

Affected Software: Victor CMS Victor CMS

Affected Versions: Version 1

Vulnerability: This vulnerability affects the initial version of Victor CMS. While the specific function is not detailed, the High severity CVSS score suggests an unauthenticated attacker could potentially exploit the application’s request handling to perform unauthorized actions or access restricted data.

Business Impact

Successful exploitation could result in the total loss of confidentiality and integrity for the hosted website. This includes the potential for site defacement, administrative account takeover, and the exposure of sensitive user databases. The CVSS score of 8.2 justifies a high-priority response from IT security teams.

Remediation Plan

Immediate Action: Apply all available security updates for Victor CMS version 1 or migrate to a more modern, secured content management framework.

Proactive Monitoring: Monitor for unexpected changes to core application files and audit user account creation logs for unauthorized administrative entries.

Compensating Controls: Ensure the web server is running with least-privilege permissions and implement robust input filtering via a WAF.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. As a late-disclosed 2020 vulnerability, users should assume that scanning for this flaw may increase following the formal advisory.

Analyst Recommendation

We recommend an immediate assessment of all Victor CMS installations. Given the High severity rating, the primary remediation—updating the software—should be completed during the next available maintenance window to ensure the security of the environment.

Description Summary:
LanSend 3.2 contains a buffer overflow in its file import functionality, allowing remote attackers to execute arbitrary code through a crafted payload file that triggers an SEH overwrite.

Executive Summary:
LanSend 3.2 is susceptible to a critical buffer overflow vulnerability that enables Remote Code Execution (RCE) when a malicious file is processed during a computer import operation.

Vulnerability Details

CVE-ID: CVE-2020-37075

Affected Software: LanSend

Affected Versions: 3.2

Vulnerability: The vulnerability is located in the "Add Computers Wizard" file import feature. An attacker can craft a malicious file that, when imported by a user, overwrites the Structured Exception Handler (SEH) and executes arbitrary shellcode on the system.

Business Impact

The CVSS score of 9.8 indicates a critical risk level. Successful exploitation allows an attacker to take complete control of the local system. In a corporate environment, this could lead to the compromise of administrative accounts and subsequent lateral movement across the network, as LanSend is typically used for network administration.

Remediation Plan

Immediate Action: Update LanSend to the latest version immediately. Discontinue the use of the file import feature until the software has been patched.

Proactive Monitoring: Review endpoint security logs for any suspicious activity triggered by the LanSend process, particularly during administrative tasks.

Compensating Controls: Utilize application whitelisting and ensure that administrative tools are run in a restricted environment with limited privileges whenever possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. Like CVE-2020-37074, this is a client-side vulnerability that relies on user interaction with a malicious file.

Analyst Recommendation

The most effective mitigation is applying the vendor's patch. Organizations should also enforce strict policies regarding the source of administrative data files and consider using sandboxed environments for performing bulk import operations to contain potential exploits.

Description Summary:
Remote Desktop Audit 2.3.0.157 is vulnerable to a buffer overflow during the file import process, allowing attackers to execute arbitrary code via a malicious payload file.

Executive Summary:
A critical buffer overflow in Remote Desktop Audit allows attackers to achieve Remote Code Execution (RCE) by tricking a user into importing a malicious computer list file.

Vulnerability Details

CVE-ID: CVE-2020-37074

Affected Software: Remote Desktop Audit

Affected Versions: 2.3.0.157

Vulnerability: The "Add Computers Wizard" fails to properly handle large or malformed inputs when importing files. By crafting a malicious file, an attacker can trigger a buffer overflow and bypass Structured Exception Handling (SEH) to execute arbitrary shellcode.

Business Impact

With a CVSS score of 9.8, this flaw represents a significant threat to administrative workstations. An attacker can gain full control over the machine used to manage remote desktop connections, potentially compromising the credentials and access to the entire server fleet managed through the software.

Remediation Plan

Immediate Action: Update Remote Desktop Audit to the latest available version and refrain from importing computer lists from untrusted or unknown sources.

Proactive Monitoring: Monitor administrative workstations for unusual process spawning (e.g., cmd.exe or powershell.exe) originating from the Remote Desktop Audit application.

Compensating Controls: Enable advanced exploit protection features like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) at the OS level to mitigate buffer overflow impacts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. This vulnerability requires a user to perform an action (importing a file), which categorizes it as a client-side attack vector.

Analyst Recommendation

Apply the software update immediately to resolve the underlying memory handling issue. Furthermore, security awareness training should emphasize the danger of importing configuration files from untrusted sources, as this is a common vector for targeting IT administrators.

Description Summary:
Victor CMS 1 is affected by a critical vulnerability that could allow for unauthorized file manipulation or system takeover.

Executive Summary:
Victor CMS 1 contains a critical vulnerability that could allow an unauthenticated attacker to compromise the integrity of the server and its hosted content.

Vulnerability Details

CVE-ID: CVE-2020-37073

Affected Software: Victor Victor CMS

Affected Versions: See vendor advisory for affected versions

Vulnerability: This critical vulnerability affects Victor CMS version 1. The CVSS score of 8.8 indicates a high-impact flaw, likely involving the ability to upload or modify files on the server without proper authentication or authorization.

Business Impact

A successful exploit could lead to the complete takeover of the CMS, allowing an attacker to steal data, host malicious content, or destroy the site's database. The 8.8 CVSS score highlights the extreme risk to the business, as it suggests the vulnerability is easily exploitable and results in total system compromise.

Remediation Plan

Immediate Action: Administrators must immediately apply any available security updates or migrate away from Victor CMS 1 to a more secure and actively maintained platform.

Proactive Monitoring: Monitor for unauthorized file changes and audit all administrative account activity for signs of compromise.

Compensating Controls: Use a WAF to block malicious traffic and implement file integrity monitoring (FIM) to alert on any unauthorized changes to the web root.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. This late disclosure suggests that organizations may have been at risk for years, making immediate remediation vital.

Analyst Recommendation

This vulnerability poses a critical threat to your web infrastructure. You must apply the primary remediation steps immediately to prevent a full system compromise and protect the organization's digital assets.

Description Summary:
Victor CMS 1 is vulnerable to a security flaw that could allow for unauthorized content manipulation or system access.

Executive Summary:
Victor CMS 1 contains a high-severity vulnerability that could allow an attacker to gain unauthorized access to the content management system and its hosted data.

Vulnerability Details

CVE-ID: CVE-2020-37072

Affected Software: Victor Victor CMS

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects Victor CMS version 1. The CVSS score of 7.2 suggests a high-impact flaw, likely involving an unauthenticated attacker's ability to bypass access controls or execute unauthorized code within the CMS environment.

Business Impact

A successful exploit could result in the total defacement of the website, the theft of user data, or the use of the server as a pivot point for further attacks. This poses a significant risk to the organization's public reputation and the integrity of the information presented on its web platforms.

Remediation Plan

Immediate Action: Organizations using Victor CMS 1 should immediately apply any available security patches or migrate to a supported, secure version of the software.

Proactive Monitoring: Monitor web server logs for suspicious POST requests or attempts to access administrative directories (e.g., /admin).

Compensating Controls: Implement a Web Application Firewall (WAF) to block common CMS attack patterns, such as SQL injection or cross-site scripting, which may be leveraged here.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure, meaning the vulnerability has existed for some time, increasing the likelihood that automated scanners may already be looking for it.

Analyst Recommendation

The immediate application of vendor-provided patches is essential. Given the high severity and the potential for website compromise, security teams should prioritize this update to protect their external-facing web infrastructure.

Description Summary:
The CraftCMS vCard Plugin 1.0.0 is vulnerable to unauthenticated remote code execution via a deserialization flaw in the vCard download functionality.

Executive Summary:
An unauthenticated remote code execution vulnerability in the CraftCMS vCard Plugin 1.0.0 allows attackers to execute arbitrary PHP code via crafted serialized payloads.

Vulnerability Details

CVE-ID: CVE-2020-37071

Affected Software: CraftCMS vCard Plugin

Affected Versions: 1.0.0

Vulnerability: This is a deserialization of untrusted data vulnerability (CWE-502) that allows unauthenticated attackers to trigger remote code execution by sending a specially crafted request to the plugin's vCard download endpoint.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary code on the underlying server, leading to a complete compromise of the CMS and potentially the entire host environment. With a CVSS score of 9.8, this vulnerability poses a critical threat to the confidentiality and integrity of the application.

Remediation Plan

Immediate Action: Users should immediately uninstall or disable the vCard plugin if it is not business-critical until a verified security patch is released by the developer.

Proactive Monitoring: Inspect web access logs for requests to vCard download endpoints containing serialized PHP objects or suspicious character sequences.

Compensating Controls: Implement WAF rules to inspect and block incoming HTTP requests that contain serialized PHP structures (e.g., 'O:').

Exploitation Status

Public Exploit Available: Yes — a public exploit is available on ExploitDB and documented on GitLab.

Analyst Notes: As of Feb 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation without authentication.

Analyst Recommendation

Due to the critical nature of this remote code execution vulnerability and the presence of publicly available exploit code, immediate removal or restriction of the affected plugin is required. Organizations should treat this as a high-priority incident until the component is removed or patched.

Description Summary:
A buffer overflow vulnerability in CloudMe 1.11.2 allows unauthenticated remote attackers to execute arbitrary code by sending crafted packets to port 8888.

Executive Summary:
CloudMe 1.11.2 contains a critical buffer overflow vulnerability that allows unauthenticated remote code execution, posing a severe risk of complete system takeover.

Vulnerability Details

CVE-ID: CVE-2020-37070

Affected Software: CloudMe

Affected Versions: 1.11.2

Vulnerability: A buffer overflow exists in the way the CloudMe service processes incoming network packets on port 8888. An unauthenticated attacker can send a specially crafted payload to overflow the buffer and gain control of the execution flow.

Business Impact

The CVSS score of 9.8 highlights the extreme risk of Remote Code Execution (RCE). Successful exploitation allows an attacker to run arbitrary commands on the host system with the privileges of the CloudMe service, leading to data theft, ransomware deployment, or use of the system as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Update CloudMe to the latest version that includes the fix for this buffer overflow and close port 8888 to the public internet.

Proactive Monitoring: Monitor network traffic for unusual or oversized packets directed at port 8888 and audit system processes for unauthorized activity.

Compensating Controls: Implement an Intrusion Prevention System (IPS) to detect and block buffer overflow signatures and use host-based security tools to monitor for suspicious execution patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. However, buffer overflows in network-facing services are classic targets for high-impact exploits.

Analyst Recommendation

The primary remediation is to apply the vendor's security patch immediately. If an update is not possible, the CloudMe service should be disabled or strictly firewalled to prevent any untrusted network communication with the vulnerable port.

Description Summary:
Konica Minolta FTP Utility 1.0 is vulnerable to a buffer overflow in the NLST command, allowing unauthenticated attackers to crash the service or potentially execute unauthorized code.

Executive Summary:
A critical buffer overflow vulnerability in Konica Minolta FTP Utility 1.0 allows for remote code execution, posing a significant risk to system availability and integrity.

Vulnerability Details

CVE-ID: CVE-2020-37069

Affected Software: Konica Minolta FTP Utility

Affected Versions: 1.0

Vulnerability: This is a classic buffer overflow (CWE-120) occurring within the NLST command handler. The vulnerability is remotely exploitable by an unauthenticated attacker who can send an oversized buffer to corrupt system registers.

Business Impact

Successful exploitation of this vulnerability could lead to a complete service disruption or unauthorized code execution on the host server. Given the CVSS score of 9.8, this flaw represents a critical risk, potentially granting an attacker full control over the affected system and facilitating further lateral movement within the network.

Remediation Plan

Immediate Action: Review the Konica Minolta support portal for the latest patch or version upgrade; if no patch is available, disable the service immediately.

Proactive Monitoring: Monitor network traffic for anomalous FTP command sequences and review system logs for signs of service crashes or unauthorized process execution.

Compensating Controls: Deploy a Web Application Firewall or Network Intrusion Prevention System (IPS) with signatures configured to detect and block oversized input buffers directed at FTP services.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry (48502) exists.

Analyst Notes: As of Feb 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ability to be triggered via simple network interaction.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate action. Administrators should prioritize identifying and patching all instances of this utility or removing the software from the environment to eliminate the attack surface.

Description Summary:
Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the LIST command, allowing unauthenticated attackers to cause a crash or execute unauthorized code.

Executive Summary:
A critical buffer overflow in the Konica Minolta FTP Utility 1.0 LIST command permits remote code execution, creating a high-risk security exposure.

Vulnerability Details

CVE-ID: CVE-2020-37068

Affected Software: Konica Minolta FTP Utility

Affected Versions: 1.0

Vulnerability: The application suffers from a buffer overflow (CWE-120) due to inadequate input validation in the LIST command. An unauthenticated attacker can send a malicious, oversized buffer to overwrite system registers, leading to service failure or code execution.

Business Impact

The potential for remote code execution makes this a high-priority threat, as it allows attackers to bypass standard authentication controls. With a CVSS score of 9.8, the business impact includes potential data exfiltration, system compromise, and significant operational downtime if the FTP service is critical to business processes.

Remediation Plan

Immediate Action: Update to the latest version of the utility if available; otherwise, decommission the service if it is not business-critical.

Proactive Monitoring: Analyze FTP traffic logs for unusual patterns or abnormally long command strings that match the identified attack vector.

Compensating Controls: Restrict access to the FTP service using firewalls to allow only known-trusted IP addresses and employ IPS rules to filter traffic for buffer overflow signatures.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry (48501) exists.

Analyst Notes: As of Feb 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication required to trigger the overflow.

Analyst Recommendation

Given the critical nature of this vulnerability and the presence of public exploit code, organizations must treat this as a high-priority remediation item. Patching or removal of the vulnerable software is the only effective way to mitigate the risk of unauthorized access.

Description Summary:
Filetto 1.0 FTP server contains a denial of service (DoS) vulnerability in the FEAT command processing. Sending an oversized command causes a buffer overflow and service crash.

Executive Summary:
A critical buffer overflow vulnerability in the Filetto FTP Server allows unauthenticated attackers to remotely crash the service, resulting in a persistent denial of service.

Vulnerability Details

CVE-ID: CVE-2020-37067

Affected Software: Filetto FTP Server

Affected Versions: Version 1.0

Vulnerability: The vulnerability occurs during the processing of the FTP "FEAT" command. An unauthenticated attacker can send a specially crafted FEAT command containing 11,008 bytes of repeated characters, which triggers a buffer overflow and causes the FTP service to terminate unexpectedly.

Business Impact

Successful exploitation results in the immediate unavailability of the FTP service, disrupting file transfer operations and potentially impacting business workflows that rely on the server. While primarily a Denial of Service, the CVSS score of 9.8 suggests that the underlying memory corruption could potentially be leveraged for more advanced exploitation.

Remediation Plan

Immediate Action: Update Filetto FTP Server to the latest version or migrate to a more robust and regularly maintained FTP solution such as FileZilla Server or an SFTP-based alternative.

Proactive Monitoring: Configure automated alerts to notify administrators if the FTP service stops unexpectedly and monitor network traffic for unusually large FTP command strings.

Compensating Controls: Implement an Intrusion Prevention System (IPS) with signatures designed to detect and drop oversized or malformed FTP commands, specifically targeting the FEAT verb.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. DoS vulnerabilities in FTP servers are frequently used as a precursor to broader attacks or to disrupt defensive operations.

Analyst Recommendation

The Filetto FTP Server version 1.0 is highly susceptible to remote disruption. Given the age of the software and the criticality of the flaw, it is recommended to replace this software with a modern, secure alternative that supports encrypted transfers and has a proven track record of security patching.

Description Summary:
GoldWave 5.70 is vulnerable to a stack-based buffer overflow in the File Open URL dialog. Attackers can use Unicode-encoded shellcode in a text file to execute commands upon opening.

Executive Summary:
A critical stack-based buffer overflow in GoldWave 5.70 enables attackers to execute arbitrary code on a user's system by tricking them into opening a specially crafted URL or file.

Vulnerability Details

CVE-ID: CVE-2020-37066

Affected Software: GoldWave

Affected Versions: Version 5.70

Vulnerability: The vulnerability exists in the "File Open URL" dialog handler. By crafting a malicious text file containing Unicode-encoded shellcode and a long string, an attacker can trigger a stack-based overflow when the user attempts to open the malicious input, leading to arbitrary command execution.

Business Impact

Successful exploitation results in arbitrary code execution with the privileges of the logged-in user. This could lead to unauthorized access to sensitive files, credential theft, and the establishment of a persistent presence on the corporate network. The CVSS score of 9.8 underscores the high severity of this remote exploitation vector.

Remediation Plan

Immediate Action: Update GoldWave to the latest version immediately. Users should be cautioned against opening suspicious URLs or files from untrusted sources within the application.

Proactive Monitoring: Review system logs for suspicious child processes spawned by GoldWave.exe and monitor for unauthorized network activity following file-open operations.

Compensating Controls: Utilize application whitelisting and ensure that "Open URL" features are restricted or monitored by host-based security software.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the requirement for user interaction (opening a file/URL) is a common social engineering tactic used in targeted attacks.

Analyst Recommendation

The ability to execute code via a standard file-open dialog is a critical security failure. Organizations must ensure that GoldWave is updated to a patched version across all endpoints. Furthermore, security awareness training should emphasize the risks of processing untrusted files in multimedia software.

Description Summary:
StreamRipper32 version 2.6 contains a buffer overflow in the Station/Song Section. Attackers can provide a malicious SongPattern input to overwrite memory and execute arbitrary code.

Executive Summary:
A critical buffer overflow vulnerability in StreamRipper32 allows unauthenticated attackers to execute arbitrary code and gain full control over the host system via crafted song patterns.

Vulnerability Details

CVE-ID: CVE-2020-37065

Affected Software: StreamRipper32

Affected Versions: Version 2.6

Vulnerability: This is a classic buffer overflow vulnerability residing in the Station/Song Section. An unauthenticated attacker can craft a malicious payload exceeding 256 bytes in the SongPattern input, triggering a memory overwrite that allows for arbitrary code execution.

Business Impact

A successful exploit grants the attacker the same privileges as the user running the StreamRipper32 application. This can lead to full system compromise, including the installation of malware, data exfiltration, and lateral movement within the network. The CVSS score of 9.8 reflects the critical nature of remote code execution (RCE) vulnerabilities.

Remediation Plan

Immediate Action: Discontinue the use of StreamRipper32 version 2.6 and update to the latest available version or an alternative secure streaming utility.

Proactive Monitoring: Security teams should monitor for unusual process behavior originating from the StreamRipper32 executable, such as unexpected network connections or shell spawning.

Compensating Controls: Implement Endpoint Detection and Response (EDR) solutions to detect and block memory exploitation attempts and buffer overflow techniques at the host level.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation of this vulnerability. Buffer overflows in legacy media applications are common targets for exploit researchers, making the potential for exploitation high.

Analyst Recommendation

Organizations should immediately identify and update or remove any instances of StreamRipper32 2.6 within their environment. Because this vulnerability allows for unauthenticated remote code execution, it represents a significant risk to any workstation where the software is deployed.

Description Summary:
EPSON EasyMP Network Projection 2 contains a vulnerability that could lead to unauthorized system access or service disruption during network projection sessions.

Executive Summary:
A vulnerability in EPSON EasyMP Network Projection 2 poses a high risk to systems utilizing network-based projection, potentially allowing for unauthorized remote interference.

Vulnerability Details

CVE-ID: CVE-2020-37064

Affected Software: EPSON EasyMP Network Projection 2

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability exists within the EPSON EasyMP Network Projection 2 software, which facilitates screen sharing over a network. While the specific mechanism is not detailed, such software often suffers from improper input validation or insecure session handling, which an attacker could exploit to disrupt presentations or potentially execute code.

Business Impact

Successful exploitation could allow an attacker to hijack active projection sessions, leading to the exposure of sensitive information during meetings or corporate events. A CVSS score of 7.8 indicates a High severity, reflecting a significant risk to confidentiality and integrity. Beyond information leakage, this flaw could be used as an entry point into the user's workstation, jeopardizing the security of the broader corporate network.

Remediation Plan

Immediate Action: Apply the latest security patches or software updates provided by EPSON for the EasyMP Network Projection 2 application.

Proactive Monitoring: Review network logs for unusual traffic on ports associated with EPSON projection services and monitor endpoint security alerts for suspicious process behavior.

Compensating Controls: Use encrypted projection methods where possible and ensure that projection software is only run on secured, authenticated network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, projection software is a high-value target for industrial espionage and corporate disruption.

Analyst Recommendation

We recommend that all users of EPSON EasyMP Network Projection 2 update their software immediately to the latest version. IT departments should audit all presentation room hardware and associated laptops to ensure compliance. Immediate patching is the only effective way to mitigate the risk associated with this High-severity vulnerability.

Description Summary:
TFTP Turbo 4 is affected by a security vulnerability that may compromise the integrity of file transfers or service availability. High-severity risk requires immediate administrative attention.

Executive Summary:
A high-severity vulnerability in TFTP Turbo 4 could allow attackers to disrupt file transfer services or gain unauthorized access to sensitive system data.

Vulnerability Details

CVE-ID: CVE-2020-37063

Affected Software: TFTP Turbo 4

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability resides in the TFTP Turbo 4 service, a protocol frequently used for automated configuration and booting. The flaw likely involves a failure to properly validate incoming requests, which could be leveraged by an attacker to cause a service failure or manipulate file operations.

Business Impact

The compromise of a TFTP server can lead to the distribution of malicious firmware or configuration files to networked devices, such as VoIP phones or routers. With a CVSS score of 7.8, this High-severity flaw threatens the integrity of the automated provisioning process. Successful exploitation could result in unauthorized data exfiltration or a complete halt of deployment workflows, causing substantial reputational and operational damage.

Remediation Plan

Immediate Action: Update TFTP Turbo 4 to the most recent version available from the vendor to close the identified security gap.

Proactive Monitoring: Enable detailed logging for all TFTP transactions and monitor for unexpected file requests or source IP addresses that do not match known provisioning clients.

Compensating Controls: Implement strict firewall rules to ensure the TFTP service is only reachable by necessary endpoints and use a Web Application Firewall (WAF) or IPS where applicable to filter malicious traffic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the inherent lack of authentication in the TFTP protocol, vulnerabilities in its implementation are particularly dangerous and attractive to attackers.

Analyst Recommendation

Given the critical role TFTP plays in device management, this vulnerability should be remediated within the current maintenance cycle. We strongly recommend applying the vendor's security updates immediately. In the interim, ensure the service is isolated from the public internet and restricted to trusted internal segments.

Description Summary:
A vulnerability exists in DHCP Turbo 4 that could allow for unauthorized actions or service disruption. Precise technical details are limited, necessitating immediate vendor consultation.

Executive Summary:
DHCP Turbo 4 contains a high-severity vulnerability that poses a significant risk to network infrastructure stability and security.

Vulnerability Details

CVE-ID: CVE-2020-37062

Affected Software: DHCP Turbo 4

Affected Versions: See vendor advisory for affected versions

Vulnerability: This vulnerability affects DHCP Turbo 4, a critical network service component. Based on the CVSS score and product type, the flaw likely involves improper handling of network packets or configuration files, potentially allowing an attacker to impact service availability.

Business Impact

A successful exploit of this vulnerability could lead to significant network downtime or unauthorized modification of DHCP configurations. Given the CVSS score of 7.8, the severity is High; an attacker could potentially disrupt IP address assignment across the enterprise, leading to widespread connectivity issues and operational paralysis. The resulting loss of productivity and potential for secondary attacks on unmanaged network segments represents a critical business risk.

Remediation Plan

Immediate Action: Administrators should apply the latest security updates provided by the vendor immediately to mitigate the risk of exploitation.

Proactive Monitoring: Monitor DHCP server logs for unusual request patterns, frequent service restarts, or unauthorized configuration changes.

Compensating Controls: Restrict access to the DHCP management interface to authorized administrative subnets and implement network segmentation to limit the blast radius of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, because DHCP services are foundational to network operations, the potential impact of an exploit is extremely high, and discovery by malicious actors is a constant threat.

Analyst Recommendation

The high CVSS score of 7.8 underscores the necessity of treating this vulnerability with high priority. Organizations relying on DHCP Turbo 4 must verify their current version and apply vendor-supplied patches immediately. Failure to secure this service could leave the entire network infrastructure vulnerable to denial-of-service or redirection attacks.

Description Summary:
BOOTP Turbo 2.0.1214 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges.

Executive Summary:
The BOOTP Turbo service is vulnerable to an unquoted service path flaw that enables local attackers to escalate privileges to LocalSystem.

Vulnerability Details

CVE-ID: CVE-2020-37061

Affected Software: Weird Solutions BOOTP Turbo

Affected Versions: 2.0.1214

Vulnerability: This is an unquoted search path vulnerability (CWE-428) where the service binary path lacks proper quotation marks. A local attacker with low privileges can place a malicious executable in a parent directory of the path, causing the system to execute the attacker's code instead of the legitimate service when the process starts with LocalSystem privileges.

Business Impact

The exploitation of this vulnerability allows a local user to gain full administrative control over the affected system. Given the CVSS score of 7.8, this represents a high-severity risk to business operations, as it facilitates complete system compromise, the potential for lateral movement within the network, and the unauthorized access of sensitive data hosted on the server.

Remediation Plan

Immediate Action: Since a specific patch is not confirmed, administrators should manually modify the Windows Service configuration to add double quotes to the binary path (e.g., changing "C:\Program Files\BOOTP Turbo\bootpt.exe" to ""C:\Program Files\BOOTP Turbo\bootpt.exe"").

Proactive Monitoring: Audit Windows services for unquoted service paths and monitor system logs for unusual service startup events or the creation of unexpected executable files in the Program Files directory structure.

Compensating Controls: Restrict local file system write permissions for non-administrative users in the installation directories of critical services to prevent the placement of malicious binaries.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists via the Exploit-DB entry 48078.

Analyst Notes: As of February 3, 2026, there is no confirmed active exploitation in the wild; however, a published exploit exists, which elevates the risk of this vulnerability significantly. The flaw is inherently easy to exploit for any local user with basic write access to the disk.

Analyst Recommendation

The severity of this vulnerability necessitates immediate manual intervention by IT administrators to secure service configurations. Because the exploit is publicly available and trivial to execute, organizations must prioritize the remediation of this service path to prevent local privilege escalation and subsequent full system compromise.

Description Summary:
Atomic Alarm Clock 6.3 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with SYSTEM privileges by placing a malicious executable on the system.

Executive Summary:
A local privilege escalation vulnerability in Atomic Alarm Clock 6.3 permits an attacker to achieve full system compromise by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2020-37060

Affected Software: Drive-Software Atomic Alarm Clock

Affected Versions: 6.3

Vulnerability: The application is vulnerable to an unquoted service path flaw (CWE-428) in the AtomicAlarmClock service. An attacker with local access can place a malicious file named Program.exe in the root directory to intercept the service execution and run arbitrary code with SYSTEM privileges.

Business Impact

Successful exploitation of this vulnerability leads to a complete loss of confidentiality, integrity, and availability at the operating system level. By gaining SYSTEM privileges, an attacker can bypass all local security controls, install persistent backdoors, or exfiltrate sensitive data. Given the CVSS score of 7.8, this represents a high-risk security gap for any environment where this software is deployed on shared or multi-user Windows workstations.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should immediately disable the affected service or restrict file system write permissions on the root drive to prevent unauthorized placement of the malicious executable.

Proactive Monitoring: Review system logs for the creation of unauthorized executables in the root drive and monitor for unexpected service restarts or modifications to the AtomicAlarmClock service configuration.

Compensating Controls: Use Endpoint Detection and Response (EDR) tools to alert on unauthorized process execution originating from the service path and enforce strict Principle of Least Privilege for local user accounts.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exploit is available via ExploitDB (EDB-ID: 48352).

Analyst Notes: As of February 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit for any user with local write access to the root directory.

Analyst Recommendation

The risk posed by this vulnerability is significant due to the escalation of privileges to the highest possible level. Because there is no known official patch, organizations should prioritize removing the software or implementing the recommended compensating controls to prevent local users from achieving system-wide persistence.

Description Summary:
Popcorn Time 6.2.1.14 is vulnerable to an unquoted service path flaw, allowing local users to execute arbitrary code with SYSTEM-level privileges.

Executive Summary:
A local privilege escalation vulnerability in Popcorn Time 6.2.1.14 allows low-privileged users to achieve full system compromise by exploiting an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2020-37059

Affected Software: Popcorn Time

Affected Versions: 6.2.1.14

Vulnerability: The application installs a service with an unquoted file path, which permits a local, authenticated user to place malicious executables in the path hierarchy. Upon service startup, the system executes the attacker-supplied code with SYSTEM-level privileges.

Business Impact

Successful exploitation grants an attacker full control over the affected machine, leading to complete system compromise. This risk is significant because it allows a low-privileged user to bypass security boundaries, potentially leading to unauthorized data access, the installation of persistent backdoors, or lateral movement within the network. The CVSS score of 7.8 reflects the high severity of achieving elevated privileges on a local system.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict folder permissions on the affected drive paths to ensure that only authorized accounts have write access to the directories containing the vulnerable service path.

Proactive Monitoring: Monitor Windows Event Logs for unexpected service installations or modifications, and audit the "Update service" configuration using the sc qc command to verify if the Binary_Path_Name is properly quoted.

Compensating Controls: Implement strict Application Whitelisting (AWL) policies to prevent the execution of unauthorized or untrusted binaries from system directories.

Exploitation Status

Public Exploit Available: Yes, a local exploit is documented on ExploitDB (EDB-ID: 48378).

Analyst Notes: As of February 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable for any user with local access to the system, as it requires only standard file manipulation to redirect the service execution.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high-impact nature of local privilege escalation, organizations should prioritize restricting local user permissions. If the application is not business-critical, uninstalling the software is the most effective way to eliminate this risk until a vendor-supplied update is released.

Description Summary:
The Andrea ST Filters Service 1.0.64.7 is vulnerable to an unquoted service path flaw, allowing local attackers to execute arbitrary code with elevated LocalSystem privileges.

Executive Summary:
A local privilege escalation vulnerability in the Andrea ST Filters Service allows attackers to execute code with system-level permissions.

Vulnerability Details

CVE-ID: CVE-2020-37058

Affected Software: Andrea Electronics Andrea ST Filters Service

Affected Versions: 1.0.64.7

Vulnerability: The application utilizes an unquoted service path in its Windows configuration, which permits a local user to place a malicious executable in a parent directory of the service path. This results in the malicious code executing with LocalSystem privileges when the service starts.

Business Impact

Successful exploitation of this vulnerability grants a local attacker full administrative control over the affected Windows host. This could lead to complete system compromise, the installation of persistent backdoors, and the potential exfiltration of sensitive information, justifying the high CVSS score of 7.8.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should manually configure the service path to be properly quoted within the Windows Registry or disable the service if it is not business critical.

Proactive Monitoring: Monitor system logs for unauthorized service modifications and inspect the file system for suspicious executables placed within the directory paths of legitimate services.

Compensating Controls: Implement strict file system permissions to prevent low-privileged users from writing files to the directory paths occupied by system services.

Exploitation Status

Public Exploit Available: Yes, a technical proof-of-concept exists as documented in the Exploit-DB entry 48396.

Analyst Notes: As of February 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user with write access to the service's base directory.

Analyst Recommendation

Given the potential for full system compromise via privilege escalation, organizations using the Andrea ST Filters Service must prioritize securing the service configuration. Administrators should immediately audit the registry for unquoted service paths and apply protective permissions to the installation directories to prevent unauthorized code injection.

Description Summary:
Online-Exam-System 2015 is vulnerable to SQL injection in the feedback module, allowing unauthenticated attackers to manipulate database queries via the fid parameter.

Executive Summary:
A critical SQL injection vulnerability in the Online-Exam-System 2015 feedback module allows unauthenticated remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2020-37057

Affected Software: sunnygkp10 Online-Exam-System

Affected Versions: 2015

Vulnerability: The application fails to properly sanitize user-supplied input in the fid parameter within the feedback module, which is processed directly in a SQL query. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the database.

Business Impact

Successful exploitation of this vulnerability permits an attacker to extract, modify, or delete sensitive information stored in the application database. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to complete data compromise, loss of confidentiality, and potential service disruption for the exam platform.

Remediation Plan

Immediate Action: There is no official vendor patch available for this legacy software. Organizations should immediately restrict access to the affected web application or decommission the system if it is no longer required.

Proactive Monitoring: Review database access logs for anomalous query patterns, specifically those containing SQL syntax characters or unexpected strings within the fid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious traffic targeting the feedback module.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit-DB entry (EDB-ID: 48529).

Analyst Notes: As of February 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Due to the lack of vendor support and the presence of a publicly available exploit, this system presents a significant and unmitigated risk to the environment. IT administrators are strongly advised to isolate the affected instance from the network or replace the software with a maintained alternative immediately.

Description Summary:
Crystal Shard http-protection 0.2.0 is vulnerable to IP spoofing, allowing unauthenticated attackers to bypass security middleware by manipulating request headers.

Executive Summary:
A critical IP spoofing vulnerability in the Crystal Shard http-protection library allows unauthenticated attackers to bypass security middleware, potentially granting unauthorized access to protected resources.

Vulnerability Details

CVE-ID: CVE-2020-37056

Affected Software: Crystal Shard http-protection

Affected Versions: <= 0.2.0

Vulnerability: The vulnerability resides in the IpSpoofing middleware, which fails to validate IP addresses correctly by relying on user-controlled request headers. Unauthenticated attackers can manipulate headers like X-Forwarded-For, X-Client-IP, and X-Real-IP to bypass security checks.

Business Impact

Successful exploitation of this flaw allows an attacker to circumvent access controls, effectively neutralizing security measures designed to restrict traffic based on source IP. Given the CVSS score of 9.8, this vulnerability poses a severe risk of unauthorized access to sensitive application data or internal administrative functions, potentially leading to full system compromise depending on the deployment environment.

Remediation Plan

Immediate Action: Update the http-protection library to the latest available version beyond 0.2.0. If an update is not immediately feasible, developers must refactor the IpSpoofing middleware to validate socket data directly rather than relying on untrusted header values.

Proactive Monitoring: Review web server and application access logs for anomalous requests where the X-Forwarded-For, X-Client-IP, and X-Real-IP headers contain identical or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and normalize request headers, stripping or validating the suspect headers before they reach the application layer.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via Exploit-DB (EDB-ID: 48533).

Analyst Notes: As of January 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the reliance on easily spoofed HTTP headers for critical security logic.

Analyst Recommendation

This vulnerability represents a significant security oversight in the handling of trusted network identity. Organizations utilizing the Crystal Shard http-protection library should prioritize updating their dependencies immediately. Given the availability of a public proof-of-concept, the window for remediation is narrow, and failure to address this issue may leave applications exposed to trivial bypass attacks.

Description Summary:
SpyHunter 4 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges.

Executive Summary:
An unquoted service path vulnerability in SpyHunter 4 could allow a local attacker to gain elevated system privileges by placing malicious executables in the file system.

Vulnerability Details

CVE-ID: CVE-2020-37055

Affected Software: Enigma Software Group SpyHunter 4

Affected Versions: SpyHunter: 4

Vulnerability: The application utilizes an unquoted service path for the SpyHunter 4 Service, which fails to properly encapsulate the file path in quotation marks. This allows a local, authenticated user to place a malicious executable in a parent directory of the service path, which the operating system will prioritize and execute with LocalSystem privileges during service startup.

Business Impact

Successful exploitation of this vulnerability results in full system compromise, as the attacker gains the same level of authority as the service, which runs as LocalSystem. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to unauthorized data access, the installation of persistent malware, or complete control over the affected host.

Remediation Plan

Immediate Action: Upgrade to the latest supported version of SpyHunter, as older versions like 4 are typically deprecated and lack security maintenance. If an update is not available, uninstall the software to eliminate the risk.

Proactive Monitoring: Monitor system logs for unexpected service restarts or the creation of unauthorized executable files within the "C:\Program Files\Enigma Software Group" directory structure.

Compensating Controls: Implement strict file system permissions to prevent low-privileged users from writing files to the "C:\Program Files" or "C:\Program Files (x86)" directories, which serves as a primary defense against unquoted path hijacking.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 48172).

Analyst Notes: As of February 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is a classic path-hijacking flaw that is trivial to exploit for any user with local write access to the affected drive.

Analyst Recommendation

This vulnerability presents a significant risk to local system integrity by providing a straightforward path to privilege escalation. Organizations currently running SpyHunter 4 should prioritize migrating to a current, supported version of the software or removing the product entirely to mitigate this risk. Immediate attention is required to ensure that local user permissions are restricted to prevent the placement of malicious binaries.

Description Summary:
Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability in the sidx parameter, allowing attackers to leak sensitive database information via time-based blind injection.

Executive Summary:
Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows remote attackers to extract sensitive database information and potentially reset administrative passwords.

Vulnerability Details

CVE-ID: CVE-2020-37053

Affected Software: Naviwebs Navigate CMS

Affected Versions: 2.8.7

Vulnerability: The application is vulnerable to an authenticated SQL injection flaw within the sidx parameter of the comments functionality. An attacker with low-level user privileges can leverage time-based blind SQL injection techniques to extract database content, including user activation keys.

Business Impact

Successful exploitation allows an attacker to bypass authentication mechanisms by retrieving user activation keys, which can be used to reset administrative passwords. This compromise leads to full administrative control over the content management system, potentially resulting in unauthorized data exfiltration, site defacement, or total system takeover. The CVSS score of 7.1 underscores the high risk associated with this vulnerability, as it provides a direct path to privilege escalation within the application environment.

Remediation Plan

Immediate Action: Upgrade to a version of Navigate CMS that addresses this vulnerability, or apply the official vendor patch if available. If no patch is currently available, restrict access to the CMS administrative and comment interfaces to trusted users only.

Proactive Monitoring: Monitor server logs for unusual HTTP POST requests directed at the navigate.php endpoint, specifically looking for anomalous query parameters or unexpected time delays in server responses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, such as the use of sleep or benchmark commands, within incoming traffic.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept script is available via ExploitDB (EDB-ID 48545).

Analyst Notes: As of February 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it allows for automated exfiltration of sensitive data via standard HTTP requests.

Analyst Recommendation

Given the availability of a functional exploit script and the potential for full administrative account takeover, this vulnerability poses a significant risk to the integrity of the Navigate CMS installation. Organizations must prioritize applying security updates or implementing strict access controls to prevent unauthorized exploitation of the comments module. Failure to address this flaw could lead to a complete compromise of the application and its underlying data.

Description Summary:
AirControl 1.4.2 is vulnerable to unauthenticated remote code execution via malicious Java expression injection targeting the /.seam endpoint.

Executive Summary:
A critical remote code execution vulnerability in Ubiquiti AirControl allows unauthenticated attackers to execute arbitrary system commands, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2020-37052

Affected Software: Ubiquiti AirControl

Affected Versions: <= 1.4.2

Vulnerability: This vulnerability involves improper control of code generation (CWE-94) via Java expression injection. Unauthenticated attackers can trigger this flaw by sending a specially crafted request to the /.seam endpoint, resulting in command execution with system-level privileges.

Business Impact

Successful exploitation grants an attacker complete control over the affected AirControl instance. This level of access permits unauthorized data exfiltration, service disruption, and the potential for lateral movement within the network. Given the CVSS score of 9.8, this flaw represents a maximum-severity risk that requires immediate remediation.

Remediation Plan

Immediate Action: Update all AirControl installations to the latest available version provided by the vendor. If an update is not immediately feasible, restrict network access to the /.seam endpoint to trusted management subnets only.

Proactive Monitoring: Review web access logs for requests containing suspicious Java expression patterns or unexpected characters directed at the /.seam endpoint. Monitor system process logs for anomalous child processes spawned by the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing Java expression injection signatures, specifically targeting the /.seam URI.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exploit is available via ExploitDB (EDB-ID: 48541).

Analyst Notes: As of Jan 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the direct path to system command execution.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of functional exploit code, necessitates an urgent response. Organizations running AirControl must prioritize patching to the latest version to eliminate the injection vector. If patching cannot be performed immediately, network isolation and WAF filtering must be implemented as critical temporary measures to prevent unauthorized exploitation.

Description Summary:
The Online-Exam-System 2015 feedback form contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to extract database password hashes.

Executive Summary:
The Online-Exam-System 2015 application is vulnerable to a critical time-based SQL injection flaw that enables unauthorized database credential extraction.

Vulnerability Details

CVE-ID: CVE-2020-37051

Affected Software: sunnygkp10 Online-Exam-System

Affected Versions: 2015

Vulnerability: This is a time-based blind SQL injection vulnerability (CWE-89) located in the feedback form at the feed.php endpoint. The application fails to properly sanitize user input, allowing an unauthenticated attacker to inject malicious SQL queries and systematically exfiltrate sensitive data through time-delay responses.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms and exfiltrate database contents, including user password hashes. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to full account compromise, unauthorized access to student or administrative data, and severe reputational damage.

Remediation Plan

Immediate Action: As no official vendor patch is available, administrators should immediately disable the feedback form functionality or restrict access to the feed.php endpoint at the web server level.

Proactive Monitoring: Review web access logs for anomalous POST requests to feed.php that contain SQL keywords or unusual character patterns. Monitor database query logs for long-running queries or suspicious sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads directed at the feedback form.

Exploitation Status

Public Exploit Available: Yes: a functional exploit script is publicly available on Exploit-DB (EDB-ID 48560).

Analyst Notes: As of February 1, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a weaponized script on Exploit-DB significantly lowers the barrier to entry for attackers.

Analyst Recommendation

This vulnerability presents a clear and present danger due to the availability of a public exploit script and the lack of an official patch. Organizations still utilizing the 2015 version of the Online-Exam-System must prioritize immediate mitigation by disabling the affected endpoint. Failure to implement these controls leaves the underlying database exposed to unauthorized exfiltration.

Description Summary:
Quick Player 1.3 is susceptible to a buffer overflow vulnerability triggered by a malicious .m3l file, which allows an attacker to achieve remote code execution on the host system.

Executive Summary:
A critical buffer overflow vulnerability in Quick Player 1.3 allows for arbitrary code execution, posing a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2020-37050

Affected Software: M.J.M Soft Quick Player

Affected Versions: 1.3

Vulnerability: The application fails to properly validate the size of input provided within .m3l files, leading to a buffer overflow in the file loading mechanism. This flaw is exploitable by an unauthenticated attacker who can entice a user to open a specially crafted file.

Business Impact

Successful exploitation of this vulnerability results in full system compromise, as the attacker can execute arbitrary code with the privileges of the user running the application. Given the CVSS score of 9.8, the potential for unauthorized access, data theft, and persistent malware installation is extreme, representing a critical risk to organizational security and system integrity.

Remediation Plan

Immediate Action: Users must discontinue the use of Quick Player 1.3 and uninstall the software if no vendor-provided patch is available for their specific environment.

Proactive Monitoring: Security teams should monitor endpoint logs for unusual child processes spawned by Quick Player or unexpected network activity originating from the media player application.

Compensating Controls: Deploy Endpoint Detection and Response (EDR) solutions to identify and block the execution of payloads associated with this known buffer overflow pattern.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept and technical write-up are available via Exploit-DB (EDB-ID: 48564).

Analyst Notes: As of January 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of modern memory protections, such as ASLR and SafeSEH, in the affected binary.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate action. Organizations should prioritize the removal of Quick Player 1.3 from all systems to eliminate the risk of remote code execution. If the software is required for business operations, migrate to a secure, actively maintained alternative.

Description Summary:
Frigate 3 Professional version 3.36.0.9 contains a local buffer overflow vulnerability in the Command Line input field that allows for arbitrary code execution.

Executive Summary:
A local buffer overflow vulnerability in Frigate 3 Professional allows an attacker to execute arbitrary code with the privileges of the application user.

Vulnerability Details

CVE-ID: CVE-2020-37049

Affected Software: Frigate 3 Professional

Affected Versions: <= 3.36.0.9

Vulnerability: The application is susceptible to a classic buffer overflow (CWE-120) triggered via the Command Line input field. By providing a specially crafted input sequence, an unauthenticated local attacker can overflow the buffer, bypass Data Execution Prevention (DEP), and execute arbitrary commands.

Business Impact

A successful exploit allows an attacker to execute arbitrary code on the host system, leading to full system compromise or unauthorized access to local resources. Given the CVSS score of 8.4, this vulnerability represents a high risk to business operations, as it can be leveraged to install malware, exfiltrate sensitive local data, or pivot into other parts of the internal network.

Remediation Plan

Immediate Action: As there is no official patch currently available, users should restrict access to the Frigate 3 Professional application to authorized personnel only to prevent local exploitation.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious process executions or abnormal command-line activity originating from the Frigate 3 application process.

Compensating Controls: Implement host-based security controls, such as Endpoint Detection and Response (EDR) solutions, to detect and block unauthorized child processes spawned by the Frigate 3 executable.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the Exploit-DB entry 48563.

Analyst Notes: As of February 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the predictable nature of the buffer overflow when interacting with the Command Line interface.

Analyst Recommendation

Due to the lack of an available patch, organizations currently utilizing Frigate 3 Professional should treat this as a high-priority risk. It is strongly recommended to isolate the affected systems or transition to a supported alternative to mitigate the risk of local code execution.