What’s Vulnerable › Vulnerabilities

CVE-2021-26626: tobesoft XPLATFORM Arbitrary file execution Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-19 · updated 2026-06-17
• Weakness: CWE-20

Description

Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The passed parameter is an arbitrary code to be executed. Remote attackers can use this vulnerability to execute arbitrary remote code.

Affected products

• Tobesoft XPlatform: before 9.2.2.280 — fixed in 9.2.2.280

How to fix

Upgrade to a fixed version: Tobesoft XPlatform 9.2.2.280. Check the vendor advisory for mitigations.

References

• https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66662
• https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66662

Get alerted when CVE-2021-26626 or the next vulnerability affects your stack