CVE-2014-6070

Adiscon LogAnalyzer < 3.6.6 - Cross-Site Scripting via Hostname Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-6070. PoCs published by Dolev Farhi.

AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in LogAnalyzer 3.6.5 by changing the hostname to a malicious payload and sending a syslog message. The payload is executed when viewed in the LogAnalyzer dashboard.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in (1) index.php or (2) detail.php.

Exploits (1)

exploitdb WORKING POC

by Dolev Farhi · textwebappsmultiple

https://www.exploit-db.com/exploits/34525

View Code ZIP pw:eip

This exploit demonstrates a stored XSS vulnerability in LogAnalyzer 3.6.5 by changing the hostname to a malicious payload and sending a syslog message. The payload is executed when viewed in the LogAnalyzer dashboard.

Classification

Working Poc 95%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: LogAnalyzer <= 3.6.5

No auth needed

Prerequisites: Access to a system that can send syslog messages to the target LogAnalyzer instance · Ability to change the hostname of the sending system

MITRE ATT&CK

T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →