https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-43725.htmlhttps://patchthecve.com/cve/CVE-2021-43725.htmlWed, 17 Jun 2026 04:11:19 +0000MEDIUM 6.1: There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.https://patchthecve.com/cve/CVE-2021-33966.htmlhttps://patchthecve.com/cve/CVE-2021-33966.htmlWed, 17 Jun 2026 03:55:24 +0000MEDIUM 5.4: Cross site scripting (XSS) vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page.https://patchthecve.com/cve/CVE-2021-40973.htmlhttps://patchthecve.com/cve/CVE-2021-40973.htmlWed, 17 Jun 2026 04:07:41 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.https://patchthecve.com/cve/CVE-2021-40972.htmlhttps://patchthecve.com/cve/CVE-2021-40972.htmlWed, 17 Jun 2026 04:07:41 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter.https://patchthecve.com/cve/CVE-2021-40971.htmlhttps://patchthecve.com/cve/CVE-2021-40971.htmlWed, 17 Jun 2026 04:07:41 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.https://patchthecve.com/cve/CVE-2021-40970.htmlhttps://patchthecve.com/cve/CVE-2021-40970.htmlWed, 17 Jun 2026 04:07:41 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter.https://patchthecve.com/cve/CVE-2021-40969.htmlhttps://patchthecve.com/cve/CVE-2021-40969.htmlWed, 17 Jun 2026 04:07:41 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter.https://patchthecve.com/cve/CVE-2021-40968.htmlhttps://patchthecve.com/cve/CVE-2021-40968.htmlWed, 17 Jun 2026 04:07:41 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter.https://patchthecve.com/cve/CVE-2021-3286.htmlhttps://patchthecve.com/cve/CVE-2021-3286.htmlWed, 17 Jun 2026 04:04:53 +0000CRITICAL 9.8: SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists because of an incomplete fix for CVE-2020-35545.https://patchthecve.com/cve/CVE-2020-35545.htmlhttps://patchthecve.com/cve/CVE-2020-35545.htmlWed, 17 Jun 2026 03:13:53 +0000CRITICAL 9.8: Time-based SQL injection exists in Spotweb 1.4.9 via the query string.