Sophos Web Appliance
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Sophos Web Appliance.
By the Year
In 2026 there have been 0 vulnerabilities in Sophos Web Appliance. Last year, in 2025 Web Appliance had 1 security vulnerability published. Right now, Web Appliance is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 1 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 4 | 6.80 |
It may take a day or so for new Web Appliance vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Sophos Web Appliance Security Vulnerabilities
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint
CVE-2009-10005
- August 20, 2025
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output parameters, attackers can read sensitive files such as /etc/passwd outside the webroot.
Files or Directories Accessible to External Parties
Sophos Web Appliance v4.3.9.1 XSS via double quotes
CVE-2023-33336
4.8 - Medium
- June 30, 2023
Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double quotes.
XSS
Privileged CMD Injection in Sophos Web Appliance <4.3.10.4 ExceptionWizard
CVE-2022-4934
7.2 - High
- April 04, 2023
A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code.
Command Injection
Sophos Web Appliance <4.3.10.4 Reflected XSS in Report Scheduler
CVE-2020-36692
5.4 - Medium
- April 04, 2023
A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a malicious form that must be manually submitted by the victim while logged in to SWA.
XSS
Pre-auth Cmd Injection in Sophos Web Appliance <4.3.10.4 warn-proceed
CVE-2023-1671
9.8 - Critical
- April 04, 2023
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
Command Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Sophos Web Appliance or by Sophos? Click the Watch button to subscribe.
