CVE-2020-11803

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval() function. The user has to be authenticated on the web platform before interacting with the page.

• CWE-94

• http://packetstormsecurity.com/files/159218/SpamTitan-7.07-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://github.com/felmoltorThird Party Advisory
• https://sensepost.com/blog/2020/clash-of-the-spamtitan/Exploit, Third Party Advisory
• https://twitter.com/felmoltorThird Party Advisory
• https://www.spamtitan.com/Vendor Advisory
• http://packetstormsecurity.com/files/159218/SpamTitan-7.07-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://github.com/felmoltorThird Party Advisory
• https://sensepost.com/blog/2020/clash-of-the-spamtitan/Exploit, Third Party Advisory
• https://twitter.com/felmoltorThird Party Advisory
• https://www.spamtitan.com/Vendor Advisory

Published

Sep 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11796In JetBrains Space through 2020-04-22, the password authenti…9.8
• CVE-2020-11797An Authentication Bypass vulnerability in the Published Area…7.5
• CVE-2020-11798A Directory Traversal vulnerability in the web conference co…5.3
• CVE-2020-11799Z-Cron 5.6 Build 04 allows an unprivileged attacker to eleva…9.8
• CVE-2020-1180<p>A remote code execution vulnerability exists in the way t…4.2
• CVE-2020-11800Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows …9.8
• CVE-2020-11804An issue was discovered in Titan SpamTitan 7.07. Due to impr…8.8
• CVE-2020-11805Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorre…9.8
• CVE-2020-11806In MailStore Outlook Add-in (and Email Archive Outlook Add-i…5.9
• CVE-2020-11807Because of Unrestricted Upload of a File with a Dangerous Ty…7.8
• CVE-2020-1181A remote code execution vulnerability exists in Microsoft Sh…8.8
• CVE-2020-11810An issue was discovered in OpenVPN 2.4.x before 2.4.9. An at…3.7