CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-11957 – Arbitrary Code Execution in WPS Office
https://notcve.org/view.php?id=CVE-2024-11957
04 Mar 2025 — Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough. • https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7263 – Arbitrary Code Execution in WPS Office
https://notcve.org/view.php?id=CVE-2024-7263
15 Aug 2024 — Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough. Another hyperlink parameter was not properly sanitized which leads to the execution of an arbitrary Windows library. Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.1311... • https://www.wps.com/whatsnew/pc/20240422 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.3EPSS: 43%CPEs: 1EXPL: 0CVE-2024-7262 – Kingsoft WPS Office Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2024-7262
15 Aug 2024 — Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. Using the MHTML format allows an attacker to automatically deliver a malicious library on opening the document and a single user click on a crafted hyperlink leads to the execution of the library. Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412... • https://www.wps.com/whatsnew/pc/20240422 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •