Skip to content
Fencer Vulns
critical 9.3

CVE-2007-6530 in the critical feed json

Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1, and probably other versions before 3.0, as used by…

published 2007-12-27 18 y ago modified 2026-06-16 4 mo ago also EUVD-2007-6496

cvss
9.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
36.8%
EPSS 36.8% chance of exploitation in 30 days, percentile 98%
public exploits
3
Metasploit, Exploit-DB

Summary

Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1, and probably other versions before 3.0, as used by HP Mercury LoadRunner and Groove Virtual Office, allows remote attackers to execute arbitrary code via a long argument to the AddFolder function.

Timeline

  1. First public exploit (Metasploit exploit/windows/browser/hp_loadrunner_addfolder)
  2. Published

Exploit prediction

36.83% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/browser/hp_loadrunner_addfolder HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow metasploit exploit, good rank, 2007-12-25
  • EDB-16588 HP LoadRunner 9.0 - ActiveX AddFolder Buffer Overflow (Metasploit) remote, 2010-05-09
  • EDB-4806 Persits Software XUpload Control - 'AddFolder()' Remote Buffer Overflow remote, 2007-12-28
  • marc.info http://marc.info/?l=full-disclosure&m=119863639428564&w=2 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/27025 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.