CVE-2025-53690-Analysis

CVE-2025-53690: Sitecore ViewState Deserialization 취약점 분석 개요 CVE-2025-53690은 Sitecore 제품군에서 발견된 ViewState 역직렬화 취약점으로, 노출된 ASP.NET machine key를 악용하여 원격 코드 실행이 가능한 치명적인 보안 취약점입니다. 기본 정보 CVE ID : CVE-2025-53690 CVSS 점수 : 9.0 Critical 취약점 유형 : Deserialization of Untrusted Data CWE-502 발견일 : 2025년 9월...

From LFI to RCE: Active Exploitation Detected in Gladinet and TrioFox Vulnerability

Cybersecurity company Huntress said it has observed active in-the-wild exploitation of an unpatched security flaw impacting Gladinet CentreStack and TrioFox products. The zero-day vulnerability, tracked as CVE-2025-11371 CVSS score: 6.1, is an unauthenticated local file inclusion bug that allows...

CVE-2025-3935 ScreenConnect Exposure to ASP.NET ViewState Code Injection

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys,...

VulnCheck KEV: CVE-2021-44207

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel...

dotnetnuke-expose.txt

=========================================================== DotNetNuke Default Machine Key Exposure Public Release Date: March 20, 2008 Brian Holyfield - Gotham Digital Science [email protected] Affected Software: DotNetNuke = 4.8.1 Severity: Critical...