https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-13167.htmlhttps://patchthecve.com/cve/CVE-2020-13167.htmlWed, 17 Jun 2026 02:52:43 +0000CRITICAL 9.8: Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.https://patchthecve.com/cve/CVE-2014-9617.htmlhttps://patchthecve.com/cve/CVE-2014-9617.htmlWed, 17 Jun 2026 00:18:39 +0000MEDIUM 6.1: Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.https://patchthecve.com/cve/CVE-2014-9615.htmlhttps://patchthecve.com/cve/CVE-2014-9615.htmlWed, 17 Jun 2026 00:18:39 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter to webadmin/deny/index.php.https://patchthecve.com/cve/CVE-2014-9614.htmlhttps://patchthecve.com/cve/CVE-2014-9614.htmlWed, 17 Jun 2026 00:18:38 +0000CRITICAL 9.8: The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/.https://patchthecve.com/cve/CVE-2014-9613.htmlhttps://patchthecve.com/cve/CVE-2014-9613.htmlWed, 17 Jun 2026 00:18:38 +0000CRITICAL 9.8: Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to webadmin/auth/verification.php or (2) dpid parameter to webadmin/deny/index.php.https://patchthecve.com/cve/CVE-2014-9612.htmlhttps://patchthecve.com/cve/CVE-2014-9612.htmlWed, 17 Jun 2026 00:18:38 +0000CRITICAL 9.8: SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to execute arbitrary SQL commands via the server parameter.https://patchthecve.com/cve/CVE-2014-9609.htmlhttps://patchthecve.com/cve/CVE-2014-9609.htmlWed, 17 Jun 2026 00:18:38 +0000MEDIUM 5.3: Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. (dot dot) in the log parameter in a stats action.https://patchthecve.com/cve/CVE-2014-9608.htmlhttps://patchthecve.com/cve/CVE-2014-9608.htmlWed, 17 Jun 2026 00:18:38 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.https://patchthecve.com/cve/CVE-2014-9607.htmlhttps://patchthecve.com/cve/CVE-2014-9607.htmlWed, 17 Jun 2026 00:18:38 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter.https://patchthecve.com/cve/CVE-2014-9606.htmlhttps://patchthecve.com/cve/CVE-2014-9606.htmlWed, 17 Jun 2026 00:18:38 +0000MEDIUM 6.1: Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/cate