The vulnerability allows a local attacker to cause the ASPRunner.NET application to crash by submitting an excessively long string in the table name field during database table creation. This results in a denial of service as the application terminates unexpectedly. The weakness corresponds to CWE‑807, which is a buffer overflow via string handling.

This flaw exists in Xlinesoft's ASPRunner.NET version 10.1. Any deployment of that version is susceptible when users can create database tables through the web interface.

The CVSS score of 6.9 indicates a moderate to high impact, and the EPSS score is unavailable, suggesting limited public data on exploit frequency. Attackers need local access to the application and must be able to trigger table creation to send a 10,000‑character string. No known public patches are listed, and the vulnerability is not in CISA's KEV catalog, but an exploit is documented on Exploit‑DB, implying the problem is actively exploitable. The risk is therefore significant for environments where the application is not adequately restricted.