CVE-2021-26626

CVE-2021-26626 affects Tobesoft XPlatform (execBrowser method). A input-validation flaw when the second parameter equals 'default' allows the first parameter to be passed to ShellExecuteW, enabling remote arbitrary code execution. Impact and vulnerable version range are described as Tobesoft XPla...

CVE-2021-26629

CVE-2021-26629 is a path traversal flaw affecting Tobesoft Xplatform (XPLATFORM) prior to version 9.2.2.280. The issue arises in the runtime archive handling when decompressing ZIP/.xzip archives, allowing an attacker to create arbitrary files in the parent directory via a path traversal sequence...

CVE-2020-7841

TOBESOFT XPLATFORM suffers an improper input validation vulnerability that can lead to arbitrary .hta file execution when a command string starts with http://, https://, or mailto://. The CVE-2020-7841 entry is supported by multiple sources (NVD, Red Hat, CNVD) detailing this issue and its high/c...

CVE-2020-7857

CVE-2020-7857 affects Tobesoft XPlatform prior to version 9.2.2.280. The issue is a command injection caused by insufficient validation of improper classes, allowing an unauthenticated attacker to execute arbitrary commands. Affected component/behavior: the XPlatform platform’s class validation l...