← Back

Spotweb

spotweb

Vendor: Spotweb Project • 10 CVEs

CVEs (10)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-43725
1Spotweb Project
1Spotweb
Jun 17, 2026
Mar 28, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.
CVE-2021-33966
1Spotweb Project
1Spotweb
Jun 17, 2026
Jan 21, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page.
CVE-2021-40973
1Spotweb Project
1Spotweb
Jun 17, 2026
Oct 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.
CVE-2021-40972
1Spotweb Project
1Spotweb
Jun 17, 2026
Oct 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter.
CVE-2021-40971
1Spotweb Project
1Spotweb
Jun 17, 2026
Oct 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.
CVE-2021-40970
1Spotweb Project
1Spotweb
Jun 17, 2026
Oct 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter.
CVE-2021-40969
1Spotweb Project
1Spotweb
Jun 17, 2026
Oct 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter.
CVE-2021-40968
1Spotweb Project
1Spotweb
Jun 17, 2026
Oct 1, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter.
CVE-2021-3286
1Spotweb Project
1Spotweb
Jun 17, 2026
Jan 26, 2021
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists because of an incomplete fix for CVE-2020-355...Show more
SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists because of an incomplete fix for CVE-2020-35545.Show less
CVE-2020-35545
1Spotweb Project
1Spotweb
Jun 17, 2026
Dec 17, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Time-based SQL injection exists in Spotweb 1.4.9 via the query string.