Spiceworks

9 CVEs across 3 Spiceworks products. Browse Spiceworks vulnerabilities, severities, and proof-of-concept exploits.

Spiceworks products with known CVEs

ProductCVEs
Spiceworks7
Desktop1
Help Desk Server1
Spiceworks CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2021-43609Critical9.92023-11-09An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app…
CVE-2020-25901Medium6.12020-12-18Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpage…
CVE-2020-23451High8.82020-09-15Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function.
CVE-2020-23450Medium5.42020-09-01Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/…
CVE-2015-6021Medium6.12017-04-10Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
CVE-2017-7237Critical9.82017-04-06The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data\configurations directory by lev…
CVE-2012-66582014-09-17Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocati…
CVE-2012-29562014-09-17SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2.json. N…
CVE-2014-37402014-09-11Cross-site scripting (XSS) vulnerability in SpiceWorks before 7.2.00195 allows remote authenticated users to inject arbitrary web script or HTML via the Summar…