PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated users. A low-privileged local attacker can connect to this pipe and send crafted IPC messages to trigger execution of arbitrary commands with SYSTEM privileges via an untrusted search path. This allows privilege escalation by placing a malicious shadow.exe in a controlled working directory.

Last Modified: Jul 17, 2026

Published: Jun 29, 2026

CVE-2016-20095

Matrix42 Remote Control Host 3.20.0031 Unquoted Path Privilege Escalation

Last Modified: Jun 23, 2026

Published: Jun 19, 2026

CVE-2019-19390

The Search parameter of the Software Catalogue section of Matrix42 Workspace Management 9.1.2.2765 and below accepts unfiltered parameters that lead to multiple reflected XSS issues.

Last Modified: Nov 21, 2024

Published: Apr 15, 2020

CVE-2019-19500

Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software.

Last Modified: Nov 21, 2024

Published: Apr 15, 2020

CVE-2013-2504

Cross-site scripting (XSS) vulnerability in SPS/Portal/default.aspx in Service Desk in Matrix42 Service Store 5.3 SP3 (aka 5.33.946.0) allows remote attackers to inject arbitrary web script or HTML via the query string.

Last Modified: Apr 11, 2025

Published: Dec 29, 2013

Items Per Page