← Vulnerability feed

Vulnerability record · CVE-2008-7070 · published 25 August 2009

CVE-2008-7070: Kvirc code injection vulnerability

Kvirc · Kvirc

Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followed by command line switches in a (1) irc:///, (2) irc6:///, (3) ircs:///, or (4) and ircs6:/// URI. NOTE: this might be due to an incomplete fix for CVE-2007-2951.

9.3 CVSS 2.0 High EPSS 5.1% · top 8.0% CWE-94 · Code injection
9.3CVSS 2.0 base score
5.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followed by command line switches in a (1) irc:///, (2) irc6:///, (3) ircs:///, or (4) and ircs6:/// URI. NOTE: this might be due to an incomplete fix for CVE-2007-2951.

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://retrogod.altervista.org/kvirc_342_cmd.html Exploit
http://secunia.com/advisories/32410
http://www.securityfocus.com/archive/1/498557/100/0/threaded
http://www.securityfocus.com/bid/32410 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/46779
https://www.exploit-db.com/exploits/7181
http://retrogod.altervista.org/kvirc_342_cmd.html Exploit
http://secunia.com/advisories/32410
http://www.securityfocus.com/archive/1/498557/100/0/threaded
http://www.securityfocus.com/bid/32410 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/46779
https://www.exploit-db.com/exploits/7181

Track CVE-2008-7070 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2010-2451Kvirc vulnerabilityMultiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.EPSS 2.7%9.3CVE-2010-2452Kvirc path traversal vulnerabilityDirectory traversal vulnerability in the DCC functionality in KVIrc 3.4 and 4.0 allows remote attackers to overwrite arbitrary files via unknown vect…EPSS 4.1%7.6CVE-2008-4748Kvirc improper input validation vulnerabilityFormat string vulnerability in the URI handler in KVirc 3.4.0, when set as the default application for processing IRC URIs, allows remote attackers t…EPSS 8.2%6.5CVE-2010-2785Kvirc vulnerabilityThe IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \ (backslash) characters, which allows remote authenticated use…EPSS 7.6%8.8CVE-2026-65660Microsoft sharepoint server code injection vulnerabilityImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.KEVEPSS 2.1%9.8CVE-2026-60004Gitea diffpatch API code injection enables remote code executionGitea before 1.27.1 allows remote code execution through the diffpatch API by way of Git hook installation. The flaw is a code injection issue (CWE-9…KEVEPSS 24%analysed9.5CVE-2026-72530TrueConf Server sandbox breakout via crafted script code injectionTrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5 and earlier allow a remote unauthenticated attacker to break o…KEVEPSS 1.7%analysed9.4CVE-2025-62593Ray browser-based RCE via insufficient User-Agent guardRay, an AI compute engine, contains a critical remote code execution flaw before version 2.52.0. Its defense against browser-based attacks relies on …KEVEPSS 62%analysed

Source: NIST National Vulnerability Database (record CVE-2008-7070), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.