CVE-2020-11804

An issue was discovered in Titan SpamTitan 7.07. Due to improper sanitization of the parameter quid, used in the page mailqueue.php, code injection can occur. The input for this parameter is provided directly by an authenticated user via an HTTP GET request.

• CWE-94

• http://packetstormsecurity.com/files/159218/SpamTitan-7.07-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://github.com/felmoltorThird Party Advisory
• https://sensepost.com/blog/2020/clash-of-the-spamtitan/Exploit, Third Party Advisory
• https://twitter.com/felmoltorThird Party Advisory
• https://www.spamtitan.comVendor Advisory
• http://packetstormsecurity.com/files/159218/SpamTitan-7.07-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://github.com/felmoltorThird Party Advisory
• https://sensepost.com/blog/2020/clash-of-the-spamtitan/Exploit, Third Party Advisory
• https://twitter.com/felmoltorThird Party Advisory
• https://www.spamtitan.comVendor Advisory

Published

Sep 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11797An Authentication Bypass vulnerability in the Published Area…7.5
• CVE-2020-11798A Directory Traversal vulnerability in the web conference co…5.3
• CVE-2020-11799Z-Cron 5.6 Build 04 allows an unprivileged attacker to eleva…9.8
• CVE-2020-1180<p>A remote code execution vulnerability exists in the way t…4.2
• CVE-2020-11800Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows …9.8
• CVE-2020-11803An issue was discovered in Titan SpamTitan 7.07. Improper sa…8.8
• CVE-2020-11805Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorre…9.8
• CVE-2020-11806In MailStore Outlook Add-in (and Email Archive Outlook Add-i…5.9
• CVE-2020-11807Because of Unrestricted Upload of a File with a Dangerous Ty…7.8
• CVE-2020-1181A remote code execution vulnerability exists in Microsoft Sh…8.8
• CVE-2020-11810An issue was discovered in OpenVPN 2.4.x before 2.4.9. An at…3.7
• CVE-2020-11811In qdPM 9.1, an attacker can upload a malicious .php file to…9.8