Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2026-108546

Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Spotweb Spotweb Project
Products
Spotweb Spotweb
CVE-2021-43725

There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.

CVSS 3.1 · 6.1 Medium EPSS 2.6% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb
CVE-2021-40973

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb
CVE-2021-40972

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb
CVE-2021-40971

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb
CVE-2021-40970

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb
CVE-2021-40969

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb
CVE-2021-40968

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb
CVE-2021-3286

SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists because of an incomplete fix for CVE-2020-35545.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb
CVE-2021-33966

Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Spotweb Project
Products
Spotweb