CVE-2020-35729 (CRITICAL 9.8) · Watchpost

← All vulnerabilities

CVE-2020-35729

CRITICAL 9.8CVE-2020-35729 · Published 27/12/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
klog server klogserver	`= 2.4.1`	No fix yet

Description

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

References

packetstormsecurity.com/files/160798/Klog-Server-2.4.1-Command-Injection.html · Exploit
packetstormsecurity.com/files/161123/Klog-Server-2.4.1-Command-Injection.html · Exploit
packetstormsecurity.com/files/161410/Klog-Server-2.4.1-Command-Injection.html · Exploit
mustgundogdu/Research · Exploit
mustgundogdu/Research · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free