CWE-64 Windows Shortcut Following (.LNK)
variantThe product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (18)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-1421US | high8.8 | — | ||
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vul… | ||||
| CVE-2018-8346US | high8.8 | — | ||
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Execution Vulnerability."… | ||||
| CVE-2020-1299US | high8.8 | — | ||
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vul… | ||||
| CVE-2019-1188US | high9.3 | — | ||
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.
An attacker who successfully exploited this vu… | ||||
| CVE-2012-6708US | medium6.1 | Exploit | ||
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerab… | ||||
| CVE-2018-8345US | high7.5 | — | ||
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Execution Vulnerability."… | ||||
| CVE-2025-52521US | high7.1 | — | ||
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileg… | ||||
| CVE-2025-49385US | high7.1 | — | ||
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileg… | ||||
| CVE-2025-49384US | high7.1 | — | ||
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileg… | ||||
| CVE-2021-1492US | high7.1 | — | ||
The Duo Authentication Proxy installer prior to 5.2.1 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer… | ||||
| CVE-2025-48443US | medium6.6 | — | ||
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation Vulnerability that could allow a local attacker to… | ||||
| CVE-2024-21910US | medium6.1 | — | ||
TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would res… | ||||
| CVE-2021-41562US | medium6.1 | — | ||
A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1… | ||||
| CVE-2021-39391US | medium6.1 | — | ||
Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request St… | ||||
| CVE-2018-16481US | medium6.1 | — | ||
A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before… | ||||
| CVE-2025-7376US | — | — | ||
Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.… | ||||
| CVE-2025-53503US | — | — | ||
Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including… | ||||
| CVE-2025-52837US | — | — | ||
Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportuni… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan