isweb vulnerabilities and fixes

Recent CVEs affecting isweb, with upgrade or downgrade steps. 3 tracked.

isweb has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 1. Most recent: 2018-09-28. Highest priority: CVE-2018-14956 (score 71/100).

• CVE-2018-15562 MEDIUM 6.1 DOWNGRADE CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php.
• CVE-2018-14957 CRITICAL 9.8 DOWNGRADE CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downlo
• CVE-2018-14956 CRITICAL 9.8 DOWNGRADE CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws

FAQ

How do I fix isweb vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is isweb being exploited right now?

None of the tracked isweb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which isweb CVE should I patch first?

CVE-2018-14956 currently ranks highest (71/100): CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws.

RSS feed for isweb · ← Back to latest CVEs