CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-46084
https://notcve.org/view.php?id=CVE-2024-46084
01 Oct 2024 — Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function. • http://scriptcase.com • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-46083
https://notcve.org/view.php?id=CVE-2024-46083
01 Oct 2024 — Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user's account on the platform. It is important to note that regular users can trigger actions for administrator users. • https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-46082
https://notcve.org/view.php?id=CVE-2024-46082
01 Oct 2024 — Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters. • https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-rce • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-46080
https://notcve.org/view.php?id=CVE-2024-46080
01 Oct 2024 — Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function. • https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-rce • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-46079
https://notcve.org/view.php?id=CVE-2024-46079
01 Oct 2024 — Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter. • https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-46081
https://notcve.org/view.php?id=CVE-2024-46081
01 Oct 2024 — Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned user will trigger a stored XSS, which is particularly dangerous because tasks are assigned to various users on the platform. • https://blog.hawktesters.com/zero-day-alert-scriptcase-vulnerabilities-xss • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8942 – Cross-site Scripting vulnerability on Scriptcase
https://notcve.org/view.php?id=CVE-2024-8942
24 Sep 2024 — Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_title” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their credentials. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8941 – Path Traversal vulnerability on Scriptcase
https://notcve.org/view.php?id=CVE-2024-8941
24 Sep 2024 — Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a path used in the POST parameter “field_file” by a web application. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8940 – Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase
https://notcve.org/view.php?id=CVE-2024-8940
24 Sep 2024 — Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 1CVE-2022-32199
https://notcve.org/view.php?id=CVE-2022-32199
27 Mar 2023 — db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. • https://github.com/Toxich4/CVE-2022-32199 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •