{"id":"CVE-2020-13166","aliases":["EUVD-2020-5438","GHSA-hrgv-3gf4-fvpc"],"status":"published","title":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code...","description":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.77635,"percentile":0.99566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20","CWE-798"],"published":"2020-05-19T19:29:59Z","modified":"2026-06-17T02:52:43Z","exploits":[{"source":"exploitdb","id":"EDB-48513","title":"Plesk/myLittleAdmin - ViewState .NET Deserialization (Metasploit)","type":"remote","platform":"windows","date":"2020-05-25","verified":true,"url":"https://www.exploit-db.com/exploits/48513"},{"source":"metasploit","id":"exploit/windows/http/plesk_mylittleadmin_viewstate","title":"Plesk/myLittleAdmin ViewState .NET Deserialization","type":"exploit","platform":"Windows","date":"2020-05-15","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/plesk_mylittleadmin_viewstate"}],"products":[{"vendor":"mylittletools","product":"mylittleadmin"}],"references":[{"url":"https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13166"},{"url":"https://github.com/advisories/GHSA-hrgv-3gf4-fvpc"}],"sources":{"cve":[{"id":"CVE-2020-13166","description":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.","status":"published","published":"2020-05-19T19:29:59Z","modified":"2024-08-04T12:11:19.252Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2020-5438","description":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.","status":"published","published":"2020-05-19T19:29:59Z","modified":"2024-08-04T12:11:19Z","updated_at":"2026-11-03T03:07:38.81332Z"}],"ghsa":[{"id":"GHSA-hrgv-3gf4-fvpc","title":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code...","description":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.","status":"published","published":"2022-05-24T17:18:08Z","modified":"2023-01-29T05:02:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-798"],"updated_at":"2026-11-02T14:45:07.130995Z"}],"nvd":[{"id":"CVE-2020-13166","description":"The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.","status":"published","published":"2020-05-19T20:15:10.087Z","modified":"2026-06-17T02:52:43.523Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:06:00.784809Z"}]}}