Reflected Cross-Site Scripting Vulnerability in Netsweeper Web Administration Interface
CVE-2015-20130

5.1MEDIUM

Key Information:

Vendor: Netsweeper
Status: Netsweeper
Vendor: CVE Published:; 30 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2015-20130?

Netsweeper versions before 4.0.11 and from 4.1.0 to 4.1.5 are susceptible to reflected cross-site scripting vulnerabilities in 'webadmin/reporter/view_server_log.php'. This flaw allows remote attackers to inject malicious JavaScript code through the 'log request' parameter, which is then reflected in the HTML response without proper output encoding. An attacker can craft a deceptive URL to entice users into accessing it, leading to unauthorized JavaScript execution within the affected user's browser session against the Netsweeper administration interface. This vulnerability poses significant risks to system integrity and user data.

Affected Version(s)

Netsweeper 0 < 4.0.11

Netsweeper 4.1.0 < 4.1.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2015-20130 - Proof of Concept