{"id":"CVE-2019-25287","state":"PUBLISHED","title":"Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path","description":"Adaware Web Companion version 4.8.2078.3950 contains an unquoted service path vulnerability in the WCAssistantService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\ to inject malicious code that would execute with LocalSystem privileges during service startup.","publishedAt":"2026-02-04T23:15:54.961Z","updatedAt":"2026-02-05T17:27:41.249Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Webcompanion Adaware Web Companion version"],"affected":[{"vendor":"Webcompanion","product":"Adaware Web Companion version","versions":[{"version":"4.8.2078.3950","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/47597","https://webcompanion.com/en/","https://www.vulncheck.com/advisories/adaware-web-companion-version-wcassistantservice-unquoted-service-path"],"weaknesses":["CWE-428"],"ingestedAt":"2026-10-29T19:45:53.332Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/25xxx/CVE-2019-25287.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-25287","state":"PUBLISHED","datePublished":"2026-02-04T23:15:54.961Z","dateUpdated":"2026-02-05T17:27:41.249Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-06T16:07:08.527Z"},"containers":{"cna":{"title":"Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path","descriptions":[{"lang":"en","value":"Adaware Web Companion version 4.8.2078.3950 contains an unquoted service path vulnerability in the WCAssistantService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\ to inject malicious code that would execute with LocalSystem privileges during service startup."}],"affected":[{"vendor":"Webcompanion","product":"Adaware Web Companion version","versions":[{"version":"4.8.2078.3950","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/47597","name":"ExploitDB-47597","tags":["exploit"]},{"url":"https://webcompanion.com/en/","name":"Adaware Web Companion Official Website","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/adaware-web-companion-version-wcassistantservice-unquoted-service-path","name":"VulnCheck Advisory: Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-428","lang":"en","description":"Unquoted Search Path or Element","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-02-04T23:15:54.961Z"},"datePublic":"2019-11-06T00:00:00.000Z","credits":[{"lang":"en","value":"Mariela L Martínez Hdez","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-05T17:27:29.914132Z","id":"CVE-2019-25287","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-05T17:27:41.249Z"}}]}}}