Unscored severity · published Sep 14, 2007
CVE-2007-4891
A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL,…
–
CVSS
31%
EPSS
No
On KEV
Description
A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) SyncShell, (3) SaveAs, (4) CABDefaultURL, (5) CABFileName, and (6) CABRunFile methods, which allows remote attackers to execute arbitrary programs and have other impacts, as demonstrated using absolute pathnames in arguments to StartProcess and SyncShell.
Exploitation
Is it being used?
Exploit prediction (EPSS)31.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Visual Studio · Microsoft
6.0; 6.0.0.9782 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4891
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4891
osvdb.org
http://osvdb.org/37106
secunia.com
http://secunia.com/advisories/26779
shinnai.altervista.org
http://shinnai.altervista.org/exploits/txt/TXT_AZJ5bXwXvMARqwtfe97I.html
Exploit
http://www.securityfocus.com/bid/25638
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/36572
www.exploit-db.com
https://www.exploit-db.com/exploits/4393
More from Visual Studio
8.8
CVE-2025-49739
Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network
8.8
CVE-2022-35827
Visual Studio Remote Code Execution Vulnerability
8.8
CVE-2022-35826
Visual Studio Remote Code Execution Vulnerability
8.8
CVE-2022-35825
Visual Studio Remote Code Execution Vulnerability
8.8
CVE-2022-35777
Visual Studio Remote Code Execution Vulnerability