Read the docs
TI-2014-07797 Aliases CVE-2014-9606GHSA-8xgh-f9mj-2x65

Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x…

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.

Why it matters now

EPSS 0.04156 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:*before 3.1.10; 4.0.0 to before 4.0.9; 4.1.0 to before 4.1.2VulnerableNetsweeper
  • cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:* Versions before 3.1.10; 4.0.0 to before 4.0.9; 4.1.0 to before 4.1.2 Vulnerable ·Netsweeper

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-9606
  2. 2026-10-03 Alias added: GHSA-8xgh-f9mj-2x65

References

Advisory 1

  • TI-2020-10347 Netsweeper through 6.4.3 allows unauthenticated remote code execution because… CVSS 3.1CRITICAL 9.8
  • TI-2014-07809 The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x… CVSS 3.0CRITICAL 9.8
  • TI-2014-07805 The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the… CVSS 3.1CRITICAL 9.8
  • TI-2014-07802 Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create… CVSS 3.0CRITICAL 9.8
  • TI-2014-07803 SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before… CVSS 3.1CRITICAL 9.8
  • TI-2014-07804 Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote… CVSS 3.1CRITICAL 9.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences