Kingsoft
Kingsoft WPS Office: vulnerabilidades y CVE
Kingsoft WPS Office tiene 14 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 4 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses0
Críticas4
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-7262 | Crítica (9.3) | 2.9% | ⚠ Explotación activa | 15 ago 2024 | Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-57096 | Media (5.5) | 0.15% | — | 14 may 2025 | An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file. |
| CVE-2025-2516 | Crítica (9.5) | 0.14% | — | 27 mar 2025 | The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of… |
| CVE-2024-11957 | Crítica (9.3) | 0.11% | — | 4 mar 2025 | Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attacker to load an arbitrary Windows library. The patch released… |
| CVE-2024-13187 | Media (4.8) | 0.23% | — | 8 ene 2025 | A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component TCC Handler. The manipulation leads to code… |
| CVE-2024-7263 | Crítica (9.3) | 0.39% | — | 15 ago 2024 | Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The patch… |
| CVE-2024-7262 | Crítica (9.3) | 2.9% | ⚠ Explotación activa | 15 ago 2024 | Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The… |
| CVE-2024-35205 | Alta (7.8) | 0.78% | — | 14 may 2024 | The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal.… |
| CVE-2023-31275 | Alta (7.8) | 1.7% | — | 27 nov 2023 | An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An… |
| CVE-2023-32548 | Alta (8.1) | 1.1% | — | 13 jun 2023 | OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the product to a malicious server and sends a specially crafted data,… |
| CVE-2022-26081 | Alta (7.8) | 0.83% | — | 17 mar 2022 | The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer. |
| CVE-2022-25969 | Alta (7.8) | 0.83% | — | 17 mar 2022 | The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer. |
| CVE-2022-25943 | Alta (7.8) | 0.72% | — | 9 mar 2022 | The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed. |
| CVE-2020-25291 | Alta (7.8) | 1.6% | — | 13 sept 2020 | GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This is related to QBrush::setMatrix in gui/painting/qbrush.cpp in… |
| CVE-2018-7546 | Media (5.5) | 1.4% | — | 18 jul 2018 | wpsmain.dll in Kingsoft WPS Office 2016 and Jinshan PDF 10.1.0.6621 allows remote attackers to cause a denial of service via a crafted pdf file. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.