---
id: CVE-2015-20130
title: Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php
summary: >-
  Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected
  cross-site scripting vulnerability in webadmin/reporter/view_server_log.php
  that allows remote attackers to execute arbitrary JavaScript by injecting
  malicious code thr…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Netsweeper
product: Netsweeper
affected:
  - Netsweeper < 4.0.11
  - Netsweeper >= 4.1.0 < 4.1.5
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:37:59.603693Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:38:11.242Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2015-20130'
references:
  - url: >-
      http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html
    label: Packet Storm 133034
  - url: 'https://www.exploit-db.com/exploits/37930'
    label: EDB-37930
  - url: >-
      https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/netsweeper/netsweeper-rxss.yaml
    label: Nuclei Template
  - url: 'https://www.netsweeper.com/'
    label: Vendor Homepage
  - url: >-
      https://www.vulncheck.com/advisories/netsweeper-reflected-xss-via-view-server-log-php
    label: >-
      VulnCheck Advisory: Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via
      view_server_log.php
tags:
  - cve.org
  - exploit-available
epss: 0.0029
epssPercentile: 0.21695
ingestedAt: '2026-11-05T21:36:00.653Z'
---

## Overview

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without output encoding. Attackers can craft a malicious URL and induce a user to request it, resulting in arbitrary JavaScript execution within the victim's browser session against the Netsweeper web administration interface. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

## Affected

- `Netsweeper < 4.0.11`
- `Netsweeper >= 4.1.0 < 4.1.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.