CVE-2020-13166
60Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 78%
from disclosure to weapon6 days
Published on NVDMay 19
1st PoC+6d
metasploitMay 15
exploitation probability
78%top 1% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.
Affected products
n/a · n/apublic PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/48513cve_referencepacketstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.