Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2021-47974

VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise services that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path directories like C:\Program Files\VX Search to execute arbitrary code with LocalSystem privileges when services restart.

VectorLOCAL

PublishedMay 16, 2026, 16:16

Published Bydisclosure@vulncheck.com

Base Score

Score7.8

Affected Versions

No affected versions found.

References

https://www.exploit-db.com/exploits/50026
https://www.vulncheck.com/advisories/vx-search-unquoted-service-path-privilege-escalation
https://www.vxsearch.com

Weakness Type

CWE-428

CVSS Metrics

Base Score

8.5

Vector String

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityHigh

Version

4.0

Attack Vector (AV)

LOCAL