← Vulnerability feed

Vulnerability record · CVE-2020-10560 · published 30 March 2020

CVE-2020-10560: Opensource-socialnetwork open source social network vulnerability

Opensource Socialnetwork · Open Source Social Network

An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the SiteKey to insert into a crafted URL for components/OssnComments/ossn_com.php and/or libraries/ossn.lib.upgrade.php.

5.9 CVSS 3.1 Medium EPSS 3.8% · top 10.4% CWE-338 · CWE-338
5.9CVSS 3.1 base score, v2 4.3
3.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the SiteKey to insert into a crafted URL for components/OssnComments/ossn_com.php and/or libraries/ossn.lib.upgrade.php.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/LucidUnicorn/CVE-2020-10560-Key-Recovery Third Party Advisory
https://techanarchy.net/blog/cve-2020-10560-ossn-arbitrary-file-read ExploitThird Party Advisory
https://github.com/LucidUnicorn/CVE-2020-10560-Key-Recovery Third Party Advisory
https://techanarchy.net/blog/cve-2020-10560-ossn-arbitrary-file-read ExploitThird Party Advisory

Track CVE-2020-10560 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.3CVE-2025-63441Opensource-socialnetwork open source social network cross-site scripting vulnerabilityOpen Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/friends.EPSS 0.27%6.5CVE-2025-63585Opensource-socialnetwork open source social network sql injection vulnerabilityOSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.EPSS 0.19%

Source: NIST National Vulnerability Database (record CVE-2020-10560), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.