#windows

**What privileges could be gained by an attacker who successfully exploited this vulnerability?** An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

**According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?** The word **Remote** in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. For example, when the score indicates that the **Attack Vector** is **Local** and **User Interaction** is **Required**, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.

Malicious Google sponsored results disguised as software downloads lead to malware.

This is a thorough write up of how to exploit a local privilege escalation vulnerability in iTunes for Windows version 12.13.2.3. Apple fixed this in version 12.13.3.

Book Recording App, as submitted on 2024-09-24, suffers from a persistent cross site scripting vulnerability.

OpenMediaVault version 7.4.2-2 suffers from a PHP code injection vulnerability.

Netis MW5360 suffers from a PHP code injection vulnerability.

Hikvision IP Cameras suffer from a cross site request forgery vulnerability.

GeoServer version 2.25.1 suffers from a PHP code injection vulnerability.

Gambio Online Webshop version 4.9.2.0 suffers from a PHP code injection vulnerability.