FooSun CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH FooSun CVE published 2026-10-20

CVE-2015-20128

This debrief summarizes CVE-2015-20128, an SQL injection vulnerability in FooSun DotNetCMS 1.0 and 2.0. The vulnerability allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter in City_ajax.aspx. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14. The CVE record and source item provide details on the SQL injection vulnerability, but the [truncated]