CVE-2020-37101

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\VPN Unlimited\' to replace the service executable and gain elevated system privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-371027.8Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to poteCVE-2020-371035.4DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executabCVE-2020-371047.5ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predCVE-2020-371057.1PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrarCVE-2020-371065.3Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles withoCVE-2020-371077.5Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field wCVE-2020-371087.1PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to mCVE-2020-371097.5aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the SubjecCVE-2020-37117.8Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code CVE-2020-371109.860CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queriesCVE-2020-371116.160CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GCVE-2020-371126.5GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries thr