Spotweb Project

10 CVEs across 1 Spotweb Project products. Browse Spotweb Project vulnerabilities, severities, and proof-of-concept exploits.

Spotweb Project products with known CVEs

ProductCVEs
Spotweb10
Spotweb Project CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2021-43725Medium6.12022-03-28There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web scr…
CVE-2021-33966Medium5.42022-01-21Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page.
CVE-2021-40973Medium6.12021-10-01Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri…
CVE-2021-40972Medium6.12021-10-01Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri…
CVE-2021-40971Medium6.12021-10-01Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri…
CVE-2021-40970Medium6.12021-10-01Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri…
CVE-2021-40969Medium6.12021-10-01Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri…
CVE-2021-40968Medium6.12021-10-01Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web scri…
CVE-2021-3286Critical9.82021-01-26SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: th…
CVE-2020-35545Critical9.82020-12-17Time-based SQL injection exists in Spotweb 1.4.9 via the query string.