CVE-2021-43725

MEDIUMNuclei

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-43725 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMSpotweb <= 1.5.1 - Cross Site Scripting (Reflected)CVSS 6.1

There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to session hijacking, data theft, or other attacks.

Remediation

Fixed in version 1.5.2

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2021xssspotwebunauthspotweb_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*
Shodan: title:"SpotWeb - overview"
Shodan: http.title:"spotweb - overview"
FOFA: title="spotweb - overview"
Google: intitle:"spotweb - overview"
https://github.com/spotweb/spotweb/ https://github.com/spotweb/spotweb/issues/718 https://nvd.nist.gov/vuln/detail/CVE-2021-43725 https://github.com/spotweb/spotweb/commit/2bfa001689aae96009688a193c64478647ba45a1

Source: ProjectDiscovery

References

3