Filtered by vendor Scriptcase Subscriptions
Filtered by product Scriptcase Subscriptions
Total 10 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-32199 1 Scriptcase 1 Scriptcase 2024-11-21 6.5 Medium
db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter.
CVE-2024-46080 1 Scriptcase 1 Scriptcase 2024-10-04 8 High
Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function.
CVE-2024-46081 1 Scriptcase 1 Scriptcase 2024-10-04 5.4 Medium
Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned user will trigger a stored XSS, which is particularly dangerous because tasks are assigned to various users on the platform.
CVE-2024-46083 1 Scriptcase 1 Scriptcase 2024-10-04 5.4 Medium
Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user's account on the platform. It is important to note that regular users can trigger actions for administrator users.
CVE-2024-46079 1 Scriptcase 1 Scriptcase 2024-10-04 6.1 Medium
Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter.
CVE-2024-46084 1 Scriptcase 1 Scriptcase 2024-10-04 8 High
Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.
CVE-2024-46082 1 Scriptcase 1 Scriptcase 2024-10-04 5.4 Medium
Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters.
CVE-2024-8940 1 Scriptcase 1 Scriptcase 2024-10-01 10 Critical
Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input.
CVE-2024-8941 1 Scriptcase 1 Scriptcase 2024-09-30 7.5 High
Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a path used in the POST parameter “field_file” by a web application.
CVE-2024-8942 1 Scriptcase 1 Scriptcase 2024-09-30 6.3 Medium
Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_title” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their credentials.