PatchTheCVECVE-2011-5149: Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.08 and earlier allow remote attackers to in
CVE-2011-5149 is a medium-severity flaw (CVSS 4.3) affecting spamtitan. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.08 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) testaddr or (2) testpass parameter to auth-settings.php; (3) hostname, (4) domainname, or (5) mailserver parameter to setup-relay.php; or (6) subnetmask or (7) defaultroute parameter to setup-network.php.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| EPSS exploit chance | 2.1% (top 18%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2012-08-31 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: SpamTitan 5.08 - Multiple Vulnerabilities
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2011-5149?
spamtitan: upgrade to newer than 5.08. Exact commands for each OS are on this page.
Is CVE-2011-5149 being exploited?
CVE-2011-5149 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2011-5149 affect?
CVE-2011-5149 affects spamtitan. Severity is medium (CVSS 4.3). Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.08 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) testaddr or (2) testpass parameter to auth-settings.php; (3) hostname, (4) domainnam
How urgent is CVE-2011-5149?
Priority 40/100. Public exploit reference
Software pages
Related CVEs
- CVE-2020-35658 MEDIUM 5.3 UPGRADE SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.
- CVE-2020-24046 HIGH 7.2 DOWNGRADE A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07
- CVE-2020-24045 HIGH 7.2 DOWNGRADE A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07
- CVE-2020-11804 HIGH 8.8 DOWNGRADE An issue was discovered in Titan SpamTitan 7.07
- CVE-2020-11803 HIGH 8.8 DOWNGRADE An issue was discovered in Titan SpamTitan 7.07