Idevspot's vulnerability footprint centers on a narrow range of web-based tools and affiliate platforms, including support ticketing, link-exchange, and advertising systems that typically operate in lower-tier hosting environments. The recurring weakness classes—cross-site scripting, code injection, CSRF, and sensitive information exposure—reflect the input-handling and output-encoding demands of web applications built during an era of lighter security scrutiny, and these vulnerability types frequently acquire public exploit tooling. The exposure is concentrated in legacy products such as iSupport, phpLinkExchange, and Nix Affiliate, which remain deployed in older installations despite limited active maintenance. Defenders should treat this vendor's products as candidates for replacement or hardened isolation rather than routine patching; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Idevspot over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-5326MEDIUM Cross-site request forgery (CSRF) vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers to hijack the authentication of administrators for requests t | Oct 8, 2012 | 6.8 | 30 | NO | YES |
CVE-2010-2319HIGH SQL injection vulnerability in index.php in IDevSpot TextAds 2.08 allows remote attackers to execute arbitrary SQL commands via the page parameter. | Jun 17, 2010 | 7.5 | 30 | NO | YES |
CVE-2006-4741HIGH PHP remote file inclusion vulnerability in bits_listings.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to execute arbitrary code via the svr_rootPhpStart parameter. | Sep 13, 2006 | 7.5 | 29 | NO | YES |
CVE-2006-3776HIGH PHP remote file inclusion vulnerability in order/index.php in IDevSpot (1) PhpHostBot 1.0 and (2) AutoHost 3.0 allows remote attackers to execute arbitrary PHP code via a URL in th | Jul 24, 2006 | 7.5 | 29 | NO | YES |
CVE-2006-3777HIGH PHP remote file inclusion vulnerability in index.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. | Jul 24, 2006 | 7.5 | 29 | NO | YES |
CVE-2007-6539MEDIUM PHP local file inclusion vulnerability in index.php in IDevspot iSupport 1.8 allows remote attackers to include local files via the include_file parameter. | Dec 27, 2007 | 6.8 | 27 | NO | YES |
CVE-2007-4231MEDIUM PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the svr_rootsc | Aug 8, 2007 | 6.8 | 27 | NO | YES |
CVE-2009-4434MEDIUM Directory traversal vulnerability in index.php in IDevSpot iSupport 1.8 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter | Dec 28, 2009 | 5.0 | 23 | NO | YES |
CVE-2006-4894MEDIUM Cross-site scripting (XSS) vulnerability in forms/lostpassword.php in iDevSpot NixieAffiliate 1.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the | Sep 19, 2006 | 4.3 | 22 | NO | YES |
CVE-2006-4884MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 allow remote attackers to inject arbitrary web script or HTML via (1) the suser parameter in support/ri | Sep 19, 2006 | 4.3 | 22 | NO | YES |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Idevspot.
Media articles that mention a CVE ID that affects a product developed by Idevspot — matched by CVE ID, not by vendor name.