Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-8940 | 1 Scriptcase | 1 Scriptcase | 2024-10-01 | N/A | 9.8 CRITICAL |
| Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input. | |||||
| CVE-2024-8941 | 1 Scriptcase | 1 Scriptcase | 2024-09-30 | N/A | 5.3 MEDIUM |
| Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a path used in the POST parameter “field_file” by a web application. | |||||
| CVE-2024-8942 | 1 Scriptcase | 1 Scriptcase | 2024-09-30 | N/A | 8.2 HIGH |
| Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_title” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their credentials. | |||||
| CVE-2022-32199 | 1 Scriptcase | 1 Scriptcase | 2024-02-04 | N/A | 6.5 MEDIUM |
| db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. | |||||