CVE-2020-7866

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
TobesoftXPLATFORM>= unspecified, <= 9.2.2.270

References

Timeline

Published
Jul 20, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-78677.8An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without cCVE-2020-78689.8A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionCVE-2020-78698.8An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary fCVE-2020-78707.2A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validatiCVE-2020-78719.8A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficieCVE-2020-78727.8DaviewIndy v8.98.7.0 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed format file that CVE-2020-78739.8Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary fCVE-2020-78748.8Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to causCVE-2020-78758.8DEXT5 Upload 5.0.0.117 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file bCVE-2020-78778.8A buffer overflow issue was discovered in ZOOK solution(remote administration tool) through processing 'ConnectMe' command while parsing a cCVE-2020-78789.8An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue isCVE-2020-78799.8This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME I
CVE-2020-7866: Critical severity, CVSS 9.8 | Vulnix