---
id: "CVE-2015-20130"
kind: "vulnerability"
aliases: ["CVE-2015-20130"]
title: "Netsweeper: reflected XSS in admin log viewer runs script in browser"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "netsweeper", "self-hosted", "web-filter"]
not_affected_if: ["admin-interface-restricted", "patched-version"]
published_at: "2026-10-30T15:16:44+00:00"
first_seen_at: "2026-10-30T15:31:09+00:00"
updated_at: "2026-10-30T15:33:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-20130", "first_seen_at": "2026-10-30T15:31:09+00:00"}]
---

# Netsweeper: reflected XSS in admin log viewer runs script in browser

Netsweeper's web admin page view_server_log.php reflects the log parameter into its HTML without encoding it. A remote attacker who tricks an administrator into opening a crafted link can run JavaScript in that administrator's browser session on the Netsweeper admin interface.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `webadmin/reporter/view_server_log.php` on Netsweeper web administration servers
- Check the installed Netsweeper version against the fixed releases; `unknown` for the exact command on your install

## Fix

- Netsweeper `4.0.x` before `4.0.11`: move to `4.0.11`
- Netsweeper `4.1.x` before `4.1.5`: move to `4.1.5`

## Timeline

- 2026-10-30T15:31:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-20130

## From the sources

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without output encoding. Attackers can craft a malicious URL and induce a user to request it, resulting in arbitrary JavaScript execution within the victim's browser session against the Netsweeper web administration interface. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_