xlockmore and xlockf do not properly cleanse user-injected format strings, which allows local users to gain root privileges via the -d option.
Loading...
Loading...
xlockmore and xlockf do not properly cleanse user-injected format strings, which allows local users to gain root privileges via the -d option.
October 20, 2000
April 16, 2026
Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.
Working exploit code is in the public domain (2 Exploit-DB entries). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
David Bagley xlock 4.16 - User Supplied Format String (2)
Open source ↗David Bagley xlock 4.16 - User Supplied Format String (1)
Open source ↗See which npm, PyPI, Go, and Maven packages are affected by CVE-2000-0763
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.