CWE-428 · Unquoted Search Path or Element (page 3)
Page 3 of 5 — CVEs classified under CWE-428, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-50901 | High | 8.4 | 2026-01-13 | Wondershare Dr.Fone 11.4.9 contains an unquoted service path vulnerability in the DFWSIDService that allows local users to potentially execute arbitrary code… |
CVE-2022-50900 | High | 8.4 | 2026-01-13 | Wondershare Dr.Fone 12.0.18 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges… |
CVE-2022-50693 | High | 8.4 | 2026-01-13 | Splashtop 8.71.12001.0 contains an unquoted service path vulnerability in the Splashtop Software Updater Service that allows local attackers to potentially exe… |
CVE-2019-25231 | High | 8.4 | 2026-01-08 | devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the 'DevoloNetworkService' that allows local non-privileged users to potentially e… |
CVE-2020-36903 | High | 8.4 | 2025-12-31 | Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execut… |
CVE-2024-58315 | High | 7.8 | 2025-12-30 | Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated syst… |
CVE-2025-59888 | Medium | 6.7 | 2025-12-26 | Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the … |
CVE-2021-47739 | High | 8.4 | 2025-12-23 | Epic Games Easy Anti-Cheat 4.0 contains an unquoted service path vulnerability that allows local non-privileged users to execute arbitrary code with elevated s… |
CVE-2023-53965 | High | 8.4 | 2025-12-22 | SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated… |
CVE-2022-50688 | High | 8.4 | 2025-12-22 | Cobian Backup Gravity 11.2.0.582 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated sy… |
CVE-2025-14018 | High | 7.3 | 2025-12-22 | Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redire… |
CVE-2023-53954 | Medium | 6.2 | 2025-12-19 | ActFax 10.10 contains an unquoted service path vulnerability that allows local attackers to potentially escalate privileges by exploiting the ActiveFaxServiceN… |
CVE-2023-53947 | High | 8.4 | 2025-12-19 | OCS Inventory NG 2.3.0.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges to system level. Attackers can plac… |
CVE-2023-53946 | High | 8.4 | 2025-12-19 | Arcsoft PhotoStudio 6.0.0.172 contains an unquoted service path vulnerability in the ArcSoft Exchange Service that allows local attackers to escalate privilege… |
CVE-2023-53912 | Medium | 6.2 | 2025-12-17 | USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execut… |
CVE-2025-34499 | | 2025-12-11 | AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTE… | |
CVE-2024-58288 | | 2025-12-11 | Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit t… | |
CVE-2025-66271 | Medium | 6.7 | 2025-12-09 | Clone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of… |
CVE-2025-66461 | Medium | 6.7 | 2025-12-08 | FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute arbitrary code with S… |
CVE-2020-36879 | | 2025-12-05 | Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startu… | |
CVE-2025-66575 | High | 7.8 | 2025-12-04 | VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with esc… |
CVE-2025-66269 | | 2025-11-26 | The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path in… | |
CVE-2025-66264 | | 2025-11-26 | The CMService.exe service runs with SYSTEM privileges and contains an unquoted service path. This allows a local attacker with write privileges to the filesyst… | |
CVE-2025-13433 | High | 7.0 | 2025-11-20 | A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse… |
CVE-2025-32449 | Medium | 6.7 | 2025-11-11 | Unquoted search path for some PRI Driver software before version 03.03.1002 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged… |
CVE-2025-10714 | High | 8.4 | 2025-11-11 | AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation within Microsoft Windows operating… |
CVE-2025-64151 | Medium | 6.7 | 2025-11-05 | Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the r… |
CVE-2025-62225 | Medium | 6.7 | 2025-11-05 | Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root… |
CVE-2025-12507 | High | 8.8 | 2025-10-31 | The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious prog… |
CVE-2025-60320 | Medium | 6.7 | 2025-10-29 | memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (memoQauhlp101). The affected service is… |
CVE-2025-57227 | High | 7.8 | 2025-10-29 | An unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1.5.8.3353 allows attackers to escalate privileges via placing a crafted executable file into… |
CVE-2025-12286 | High | 7.0 | 2025-10-27 | A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the c… |
CVE-2025-12247 | High | 7.0 | 2025-10-27 | A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteServ… |
CVE-2025-61865 | Medium | 6.7 | 2025-10-23 | Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on… |
CVE-2025-61871 | Medium | 6.7 | 2025-10-10 | NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the write permission on the root directory o… |
CVE-2025-57714 | High | 7.8 | 2025-10-03 | An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit… |
CVE-2025-43993 | High | 7.8 | 2025-09-25 | Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerabili… |
CVE-2025-54081 | Medium | 6.7 | 2025-09-23 | Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted ex… |
CVE-2025-9818 | Medium | 6.7 | 2025-09-17 | A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., wh… |
CVE-2025-59307 | Medium | 6.7 | 2025-09-17 | RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of… |
CVE-2025-10199 | High | 7.8 | 2025-09-09 | A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path. |
CVE-2025-58400 | Medium | 6.7 | 2025-09-05 | RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path. A user with the write permiss… |
CVE-2025-39246 | Medium | 5.3 | 2025-08-29 | There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of… |
CVE-2025-5191 | | 2025-08-25 | An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path configuration in t… | |
CVE-2025-57699 | Medium | 6.7 | 2025-08-22 | Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user with the write permi… |
CVE-2025-9043 | | 2025-08-14 | The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploit a vulnerability as… | |
CVE-2025-8070 | | 2025-07-23 | The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary… | |
CVE-2025-0035 | High | 7.3 | 2025-05-13 | Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrary code executio… |
CVE-2024-36321 | High | 7.3 | 2025-05-13 | Unquoted search path within AIM-T Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrary code execution. |
CVE-2025-4540 | High | 7.0 | 2025-05-11 | A vulnerability was found in MTSoftware C-Lodop 6.6.1.1 on Windows. It has been rated as critical. This issue affects some unknown processing of the component… |
CVE-2025-1984 | Medium | 5.2 | 2025-03-12 | Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level a… |
CVE-2025-0884 | | 2025-03-12 | Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges through Privilege… | |
CVE-2025-24831 | Medium | 6.6 | 2025-01-31 | Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before b… |
CVE-2025-21107 | High | 7.8 | 2025-01-30 | Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerability. A low privil… |
CVE-2024-57276 | High | 7.3 | 2025-01-27 | In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability. This service is configured with insecure… |
CVE-2024-9287 | High | 7.8 | 2024-10-22 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, all… |
CVE-2024-9325 | High | 7.8 | 2024-09-29 | A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Int… |
CVE-2024-8996 | High | 7.3 | 2024-09-25 | Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects… |
CVE-2024-8975 | High | 7.3 | 2024-09-25 | Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: befor… |
CVE-2024-43457 | High | 7.8 | 2024-09-10 | Windows Setup and Deployment Elevation of Privilege Vulnerability |
CVE-2022-27592 | Medium | 6.7 | 2024-09-06 | An unquoted search path or element vulnerability has been reported to affect QVR Smart Client. If exploited, the vulnerability could allow local authenticated… |
CVE-2024-5963 | Medium | 6.7 | 2024-08-06 | Unquoted Executable Path vulnerability in Hitachi Device Manager on Windows (Device Manager Server component).This issue affects Hitachi Device Manager: before… |
CVE-2024-31201 | Medium | 6.5 | 2024-07-31 | A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenarios where incorrect pe… |
CVE-2024-5402 | High | 7.8 | 2024-07-15 | Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated priv… |
CVE-2024-6080 | High | 7.8 | 2024-06-17 | A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Servi… |
CVE-2024-2747 | High | 7.8 | 2024-06-12 | CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted fi… |
CVE-2024-31226 | Medium | 4.9 | 2024-05-16 | Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when te… |
CVE-2024-3640 | | 2024-05-16 | An unquoted executable path exists in the Rockwell Automation FactoryTalk® Remote Access™ possibly resulting in remote code execution if exploited. While runni… | |
CVE-2024-4461 | High | 7.8 | 2024-05-03 | Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to in… |
CVE-2023-39464 | High | 7.2 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2024-34010 | High | 8.2 | 2024-04-29 | Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before b… |
CVE-2024-31804 | Medium | 6.7 | 2024-04-23 | An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component. |
CVE-2024-4031 | Medium | 4.4 | 2024-04-23 | Unquoted Search Path or Element vulnerability in Logitech MEVO WEBCAM APP on Windows allows Local Execution of Code. |
CVE-2024-22437 | High | 7.3 | 2024-04-15 | A potential security vulnerability has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This vulnerability could… |
CVE-2024-1618 | High | 7.8 | 2024-03-12 | A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affe… |
CVE-2024-25552 | High | 7.8 | 2024-03-01 | A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product. |
CVE-2024-24722 | Critical | 9.1 | 2024-02-19 | An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevated privileges via t… |
CVE-2023-24542 | Medium | 6.7 | 2024-02-14 | Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enabl… |
CVE-2024-1201 | High | 7.8 | 2024-02-02 | Search path or unquoted item vulnerability in HDD Health affecting versions 4.2.0.112 and earlier. This vulnerability could allow a local attacker to store a m… |
CVE-2020-24682 | High | 7.2 | 2024-02-02 | Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Ele… |
CVE-2023-7043 | Low | 3.3 | 2024-01-31 | Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\NetworkService permis… |
CVE-2023-6631 | High | 7.8 | 2024-01-08 | PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted… |
CVE-2023-32658 | Medium | 6.7 | 2023-11-14 | Unquoted search path in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may allow an authenticat… |
CVE-2023-29165 | Medium | 6.7 | 2023-11-14 | Unquoted search path or element in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentially enable esca… |
CVE-2023-25075 | Medium | 6.7 | 2023-11-14 | Unquoted search path in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to potentially… |
CVE-2023-0392 | Medium | 6.7 | 2023-11-08 | The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. |
CVE-2021-26735 | Medium | 6.7 | 2023-10-23 | The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to ex… |
CVE-2023-37537 | High | 7.8 | 2023-10-17 | An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud (ASoC), may allow a local attacker to gai… |
CVE-2023-42486 | Medium | 6.3 | 2023-09-27 | Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges. |
CVE-2023-5012 | Medium | 5.3 | 2023-09-16 | A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Wa… |
CVE-2023-4991 | High | 7.8 | 2023-09-15 | A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file QWAlerter.e… |
CVE-2023-36658 | High | 7.8 | 2023-09-15 | An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally. |
CVE-2023-22841 | Medium | 6.7 | 2023-08-11 | Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems B… |
CVE-2023-2685 | High | 7.2 | 2023-07-28 | A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, pot… |
CVE-2023-26911 | High | 7.8 | 2023-07-26 | ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes wit… |
CVE-2023-3842 | High | 7.8 | 2023-07-23 | A vulnerability was found in Pointware EasyInventory 1.0.12.0 and classified as critical. This issue affects some unknown processing of the file C:\Program Fil… |
CVE-2023-38408 | Critical | 9.8 | 2023-07-20 | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forward… |
CVE-2023-3438 | Medium | 4.4 | 2023-07-03 | An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). The misconfiguration… |
CVE-2022-0357 | Medium | 6.7 | 2023-05-24 | Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender… |
CVE-2023-31747 | High | 7.8 | 2023-05-23 | Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerabi… |