Spotweb Project
Spotweb Project Spotweb: vulnerabilidades y CVE
Spotweb Project Spotweb tiene 10 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE10
Últimos 12 meses0
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-43725 | Media (6.1) | 2.6% | — | 28 mar 2022 | There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter. |
| CVE-2021-33966 | Media (5.4) | 0.88% | — | 21 ene 2022 | Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page. |
| CVE-2021-40973 | Media (6.1) | 2.3% | — | 1 oct 2021 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter. |
| CVE-2021-40972 | Media (6.1) | 2.3% | — | 1 oct 2021 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter. |
| CVE-2021-40971 | Media (6.1) | 2.2% | — | 1 oct 2021 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter. |
| CVE-2021-40970 | Media (6.1) | 2.2% | — | 1 oct 2021 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. |
| CVE-2021-40969 | Media (6.1) | 2.2% | — | 1 oct 2021 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter. |
| CVE-2021-40968 | Media (6.1) | 2.2% | — | 1 oct 2021 | Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter. |
| CVE-2021-3286 | Crítica (9.8) | 1.0% | — | 26 ene 2021 | SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists because of an incomplete fix for… |
| CVE-2020-35545 | Crítica (9.8) | 3.8% | — | 17 dic 2020 | Time-based SQL injection exists in Spotweb 1.4.9 via the query string. |