CVE-2020-7857

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. This issue affects: Tobesoft XPlatform versions prior to 9.2.2.280.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-470 CWE-20

Affected software

Vendor	Product	Versions
Tobesoft	XPlatform	>= unspecified, < 9.2.2.280

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36006Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36006Third Party Advisory

Timeline

Published: Apr 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-78588.6There is a directory traversing vulnerability in the download page url of AquaNPlayer 2.0.0.92. The IP of the download page url is localhost CVE-2020-78607.8UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is misha CVE-2020-78619.8AnySupport (Remote support solution) before 2019.3.21.0 allows directory traversing because of swprintf function to copy file from a managem CVE-2020-78628.8A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands CVE-2020-78638.8A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted we CVE-2020-78649.8Parameter manipulation can bypass authentication to cause file upload and execution. This will execute the remote code. This issue affects: CVE-2020-78659.8A vulnerability(improper input validation) in the ExECM CoreB2B solution allows an unauthenticated attacker to download and execute an arbit CVE-2020-78669.8When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation CVE-2020-78677.8An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without c CVE-2020-78689.8A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecution CVE-2020-78698.8An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary f CVE-2020-78707.2A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validati