CVE & Exploit Intelligence Database

CVE-2019-25437 6.2 MEDIUM 1 PoC Analysis EPSS 0.00

Foscam Video Management System 1.1.6.6 contains a buffer overflow vulnerability in the UID field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 5000-character buffer into the UID parameter during device addition to trigger an application crash when the Login Check function is invoked.

CWE-121 Feb 20, 2026

CVE-2019-25435 7.8 HIGH 1 PoC Analysis EPSS 0.00

Sricam DeviceViewer 3.12.0.1 contains a local buffer overflow vulnerability in the user management add user function that allows authenticated attackers to execute arbitrary code by bypassing data execution prevention. Attackers can inject a malicious payload through the Username field in User Management to trigger a stack-based buffer overflow and execute commands via ROP chain gadgets.

CWE-121 Feb 20, 2026

CVE-2019-25434 7.5 HIGH 1 PoC Analysis EPSS 0.00

SpotAuditor 5.3.1.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting excessive data in the registration name field. Attackers can enter a large string of characters (5000 bytes or more) in the name field during registration to trigger an unhandled exception that crashes the application.

CWE-121 Feb 20, 2026

CVE-2019-25365 9.8 CRITICAL 1 PoC Analysis EPSS 0.00

ChaosPro 2.0 contains a buffer overflow vulnerability in the configuration file path handling that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler. Attackers can craft a malicious configuration file with carefully constructed payload to overwrite memory and gain remote code execution on vulnerable Windows XP systems.

CWE-121 Feb 18, 2026

CVE-2019-25364 9.8 CRITICAL 1 PoC Analysis EPSS 0.00

MailCarrier 2.51 contains a buffer overflow vulnerability in the POP3 USER command that allows remote attackers to execute arbitrary code. Attackers can send a crafted oversized buffer to the POP3 service, overwriting memory and potentially gaining remote system access.

CWE-121 Feb 18, 2026

CVE-2019-25363 7.5 HIGH 1 PoC Analysis EPSS 0.00

WMV to AVI MPEG DVD WMV Convertor 4.6.1217 contains a buffer overflow vulnerability that allows attackers to crash the application by providing an oversized license input. Attackers can generate a 6000-byte payload and paste it into the 'License Name and License Code' field to trigger an application crash.

CWE-121 Feb 18, 2026

CVE-2019-25361 9.8 CRITICAL 1 PoC Analysis EPSS 0.00

Ayukov NFTP client 1.71 contains a buffer overflow vulnerability in the SYST command handling that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted SYST command with oversized payload to trigger a buffer overflow and execute a bind shell on port 5150.

CWE-121 Feb 18, 2026

CVE-2019-25360 9.8 CRITICAL 1 PoC Analysis EPSS 0.00

Aida64 Engineer 6.10.5200 contains a buffer overflow vulnerability in the CSV logging configuration that allows attackers to execute malicious code by crafting a specially designed payload. Attackers can exploit the vulnerability by creating a malformed log file with carefully constructed SEH (Structured Exception Handler) overwrite techniques to achieve remote code execution.

CWE-121 Feb 18, 2026

CVE-2019-25357 8.4 HIGH 1 PoC Analysis EPSS 0.00

Control Center PRO 6.2.9 contains a stack-based buffer overflow vulnerability in the user creation module's username field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious payload exceeding 664 bytes to inject shellcode and potentially execute arbitrary code on vulnerable Windows systems.

CWE-121 Feb 18, 2026

CVE-2026-2329 9.8 CRITICAL 1 PoC Analysis EPSS 0.41

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

CWE-121 Feb 18, 2026

CVE-2019-25341 7.5 HIGH 1 PoC Analysis EPSS 0.00

iNetTools for iOS 8.20 contains a denial of service vulnerability in the Whois feature that allows attackers to crash the application by manipulating input. Attackers can paste a specially crafted 98-character buffer into the Domain Name field to trigger an application crash.

CWE-121 Feb 12, 2026

CVE-2019-25340 7.5 HIGH 1 PoC Analysis EPSS 0.00

SpotAuditor 5.3.2 contains a denial of service vulnerability in its Base64 decryption feature that allows attackers to crash the application by supplying an oversized buffer. Attackers can generate a malformed input file with 2000 repeated characters to trigger an application crash when pasted into the Base64 Encrypted Password field.

CWE-121 Feb 12, 2026

CVE-2019-25339 7.5 HIGH 1 PoC Analysis EPSS 0.00

GHIA CamIP 1.2 for iOS contains a denial of service vulnerability in the password input field that allows attackers to crash the application. Attackers can paste a 33-character buffer of repeated characters into the password field to trigger an application crash on iOS devices.

CWE-121 Feb 12, 2026

CVE-2019-25336 8.4 HIGH 2 PoCs Analysis EPSS 0.00

SpotAuditor 5.3.2 contains a local buffer overflow vulnerability in the Base64 Encrypted Password tool that allows attackers to execute arbitrary code by crafting a malicious payload. Attackers can generate a specially crafted Base64 encoded payload to trigger a Structured Exception Handler (SEH) overwrite and execute shellcode on the vulnerable system.

CWE-121 Feb 12, 2026

CVE-2019-25334 6.2 MEDIUM 1 PoC Analysis EPSS 0.00

Product Key Explorer 4.2.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by overflowing the registration name input field. Attackers can create a specially crafted text file with repeated characters to trigger a buffer overflow when pasted into the registration name field, causing the application to crash.

CWE-121 Feb 12, 2026

CVE-2019-25332 8.4 HIGH 2 PoCs Analysis EPSS 0.00

FTP Commander Pro 8.03 contains a local stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting the EIP register through a custom command input. Attackers can craft a malicious payload of 4108 bytes to overwrite memory and execute shellcode, demonstrating remote code execution potential.

CWE-121 Feb 12, 2026

CVE-2019-25331 8.4 HIGH 1 PoC Analysis EPSS 0.00

AVS Audio Converter 9.1 contains a local buffer overflow vulnerability that allows local attackers to overwrite CPU registers by manipulating the 'Exit folder' input field. Attackers can craft a specially designed text file with 264 bytes of padding followed by register overwrite values to compromise the application and potentially execute arbitrary code.

CWE-121 Feb 12, 2026

CVE-2019-25330 7.5 HIGH 1 PoC Analysis EPSS 0.00

SurfOffline Professional 2.2.0.103 contains a structured exception handler (SEH) overflow vulnerability that allows attackers to crash the application by manipulating the project name input. Attackers can generate a malicious payload of 382 'A' characters followed by specific byte sequences to trigger a denial of service condition and overwrite SEH registers.

CWE-121 Feb 12, 2026

CVE-2019-25329 7.5 HIGH 1 PoC Analysis EPSS 0.00

FTP Navigator 8.03 contains a denial of service vulnerability that allows attackers to crash the application by overwriting Structured Exception Handler (SEH) with malicious input. Attackers can generate a payload of 4108 'A' characters followed by 4 'B' characters and 40 'C' characters to trigger a program crash when pasted into the custom command input.

CWE-121 Feb 12, 2026

CVE-2019-25328 7.5 HIGH 1 PoC Analysis EPSS 0.00

XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the application. Attackers can generate a 9000-byte buffer of repeated characters and paste it into the registration code field to trigger an application crash.

CWE-121 Feb 12, 2026