CVE-2014-9613: Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arb...

Security readout for executives and security teams

CVE-2014-9613 affects Netsweeper versions before 2.6.29.10. A remote attacker could use vulnerable web administration paths to run arbitrary SQL commands. For executives, the concern is unauthorized access to or manipulation of filtering service data if the Netsweeper webadmin interface is exposed. Organizations are exposed if they run Netsweeper older than 2.6.29.10, especially where the webadmin interface is reachable from untrusted networks. The provided source bundle does not identify affected appliances, deployments, or CPEs. Treat this as a high-priority legacy exposure issue if Netsweeper is still deployed. The business risk is strongest where administration interfaces are internet-facing or poorly segmented. Absence from KEV reduces evidence of active exploitation, not the impact of successful SQL injection. Mitigation focus: Inventory Netsweeper deployments and identify any versions older than 2.6.29.10.; Upgrade affected systems to 2.6.29.10 or a vendor-supported later release.; Restrict webadmin access to trusted administrative networks or VPN only..

Prepared

Jun 6, 2026, 02:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.