Spotweb Project maintains a niche but prominently targeted web-based Usenet client application that has accumulated vulnerabilities skewing toward serious outcomes, with critical-severity instances appearing across its disclosure history. The exposure recurs through application-layer input-handling flaws, chiefly cross-site scripting and SQL injection, which reflect the web-interface architecture and database interaction patterns inherent to the platform; these weakness classes frequently acquire public exploit code. Defenders should treat this vendor's security updates as timely despite its narrow footprint, since the application's web-facing role makes instances in active use attractive targets; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Spotweb Project over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-35545CRITICAL Time-based SQL injection exists in Spotweb 1.4.9 via the query string. | Dec 17, 2020 | 9.8 | 32 | NO | NO |
CVE-2021-43725MEDIUM There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the d | Mar 28, 2022 | 6.1 | 31 | NO | YES |
CVE-2021-40969MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the fi | Oct 1, 2021 | 6.1 | 30 | NO | YES |
CVE-2021-40973MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the la | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-40972MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the ma | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-40971MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the ne | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-40970MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the us | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-40968MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the ne | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-3286CRITICAL SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists becau | Jan 26, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-33966MEDIUM Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page. | Jan 21, 2022 | 5.4 | 19 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Spotweb Project.
Media articles that mention a CVE ID that affects a product developed by Spotweb Project — matched by CVE ID, not by vendor name.