CVE-2014-9613 Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to webadmin/auth/verification.php or (2) dpid...

CriticalCVSS 9.8 EPSS 4.1% Public exploit

Published: 2020-02-19 21:53
Updated: 2026-06-17 03:18
Exploit status: Public exploit available

Description

Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to webadmin/auth/verification.php or (2) dpid parameter to webadmin/deny/index.php.

Affected products

Product	Affected versions	Fixed in
netsweeper	< 2.6.29.10	2.6.29.10

References

packetstormsecurity.com third-party-advisory vdb-entry

CVSS v3.1

9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.1 9.8 · nvd@nist.gov
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 4.06% (percentile 90.8)
CWE: CWE-89

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Netsweeper 2.6.29.8 - SQL Injection Exploit · Exploit Database (OffSec) · 2015-08-21