CVE-2021-40968

MEDIUM NUCLEI

spotweb <1.5.1 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter.

Nuclei Templates (1)

Spotweb <= 1.5.1 - Cross Site Scripting

MEDIUMVERIFIEDby theamanrawat

Shodan: title:"SpotWeb - overview" || http.title:"spotweb - overview"

FOFA: title="spotweb - overview"

References (2)

[Third Party Advisory] https://github.com/spotweb/spotweb

[Exploit, Issue Tracking, Third Party Advisory] https://github.com/spotweb/spotweb/issues/711

Scores

CVSS v3 6.1

EPSS 0.0129

EPSS Percentile 79.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

spotweb_project/spotweb < 1.5.1

Published Oct 01, 2021

Tracked Since Feb 18, 2026