Spotweb
Vendor:
First CVE: Dec 17, 2020 · Active for 5 years
10
Total CVEs
More Total CVEs than 88% of tracked products
3.3
Avg CVEs / Year
Higher CVE frequency than 82% of tracked products
6.8
Avg CVSS
Higher Avg CVSS than 36% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Spotweb over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 17, 2020
5 years ago
Most Recent CVE
Mar 28, 2022
1,581 days ago
CVE Severity & Scoring
Spotweb10 CVEs
80%
20%
All CVEs352,719 CVEs
45%
40%
11%
MediumCritical
Attack Vector
Local0 (0.0%)
Network10 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low10 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None2 (20.0%)
Unknown0 (0.0%)
Required8 (80.0%)
Privileges Required
Low1 (10.0%)
High0 (0.0%)
None9 (90.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-35545CRITICAL Time-based SQL injection exists in Spotweb 1.4.9 via the query string. | Dec 17, 2020 | 9.8 | 32 | NO | NO |
CVE-2021-43725MEDIUM There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the d | Mar 28, 2022 | 6.1 | 31 | NO | YES |
CVE-2021-40969MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the fi | Oct 1, 2021 | 6.1 | 30 | NO | YES |
CVE-2021-40973MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the la | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-40972MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the ma | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-40971MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the ne | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-40970MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the us | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-40968MEDIUM Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the ne | Oct 1, 2021 | 6.1 | 29 | NO | YES |
CVE-2021-3286CRITICAL SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists becau | Jan 26, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-33966MEDIUM Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page. | Jan 21, 2022 | 5.4 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (10 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
7 CVEs
70.0% of CVEs· 99th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (10 CVEs).
Media Mentions
Signals from CVEs in this product scope (10 CVEs).
Top CNAs Publishing CVEs For Spotweb
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.4.9 | 3 | 8.3 | 1.9% | 0 | 0 |