CVE-2015-20130: Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php

Q: Which Netsweeper releases are affected?

Affected releases are Netsweeper versions before 4.0.11, and versions from 4.1.0 before 4.1.5.

Q: What does an attacker need to exploit this issue?

An attacker can remotely craft a URL containing malicious JavaScript in the log request parameter and must induce a user to open it. No attacker authentication is indicated, but exploitation requires user interaction.

Q: What is the impact if exploitation succeeds?

The injected script executes in the victim's browser session in the context of the Netsweeper web administration interface. This can expose or alter information accessible through that session.

Q: How can I determine whether an instance is vulnerable?

Check the installed Netsweeper version and whether webadmin/reporter/view_server_log.php reflects the log request parameter into an HTML response without output encoding. Public proof-of-concept and scanning-template references are available in the supplied references.

Published Oct 30, 2026

Updated

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without output encoding. Attackers can craft a malicious URL and induce a user to request it, resulting in arbitrary JavaScript execution within the victim's browser session against the Netsweeper web administration interface. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Affected Software

1 affected component

Netsweeper Netsweeper<4.0.11, >=4.1.0<4.1.5

Event History

Oct 30, 2026

CVE Published

via MITRE·02:23 PM

Data Sourced

via MITRE·02:23 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Netsweeper releases are affected?

Affected releases are Netsweeper versions before 4.0.11, and versions from 4.1.0 before 4.1.5.

What does an attacker need to exploit this issue?

An attacker can remotely craft a URL containing malicious JavaScript in the log request parameter and must induce a user to open it. No attacker authentication is indicated, but exploitation requires user interaction.

What is the impact if exploitation succeeds?

The injected script executes in the victim's browser session in the context of the Netsweeper web administration interface. This can expose or alter information accessible through that session.

How can I determine whether an instance is vulnerable?

Check the installed Netsweeper version and whether webadmin/reporter/view_server_log.php reflects the log request parameter into an HTML response without output encoding. Public proof-of-concept and scanning-template references are available in the supplied references.

CVE-2015-20130: Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php

Affected Software

Event History

Frequently Asked Questions

Which Netsweeper releases are affected?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

How can I determine whether an instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which Netsweeper releases are affected?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

How can I determine whether an instance is vulnerable?