Tobesoft develops a focused suite of rapid-application-development and low-code platforms—including xPlatform, Nexacro, and miPlatform—designed for enterprise desktop and web application delivery, particularly in Asian markets. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and recur through input-validation, code-integrity, and path-traversal weaknesses that reflect the risks of dynamic code generation and file-handling in application-development frameworks. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tobesoft over time
Signals from CVEs in this vendor scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-7825CRITICAL A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An attacker could execute arbitrary remote | Jul 17, 2020 | 9.8 | 31 | NO | NO |
CVE-2021-26607CRITICAL An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems. | Oct 26, 2021 | 9.8 | 30 | NO | NO |
CVE-2020-7815CRITICAL XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to the vulnerable method. this can be levera | Jul 10, 2020 | 9.8 | 30 | NO | NO |
CVE-2019-19167CRITICAL Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It allows attacker to cause | May 6, 2020 | 9.8 | 30 | NO | NO |
CVE-2021-26612CRITICAL An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command aft | Nov 30, 2021 | 9.8 | 29 | NO | NO |
CVE-2020-7866CRITICAL When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation | Jul 20, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-26629HIGH A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be | Apr 26, 2022 | 8.8 | 28 | NO | NO |
CVE-2020-7806CRITICAL Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allows attacker to cause | May 6, 2020 | 9.8 | 28 | NO | NO |
CVE-2021-26626HIGH Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘defaul | Apr 19, 2022 | 8.8 | 27 | NO | NO |
CVE-2021-26625HIGH Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update funct | Apr 19, 2022 | 8.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (18 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tobesoft.
Media articles that mention a CVE ID that affects a product developed by Tobesoft — matched by CVE ID, not by vendor name.