CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8942 – Cross-site Scripting vulnerability on Scriptcase
https://notcve.org/view.php?id=CVE-2024-8942
24 Sep 2024 — Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_title” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their credentials. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8941 – Path Traversal vulnerability on Scriptcase
https://notcve.org/view.php?id=CVE-2024-8941
24 Sep 2024 — Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a path used in the POST parameter “field_file” by a web application. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8940 – Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase
https://notcve.org/view.php?id=CVE-2024-8940
24 Sep 2024 — Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 1CVE-2022-32199
https://notcve.org/view.php?id=CVE-2022-32199
27 Mar 2023 — db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. • https://github.com/Toxich4/CVE-2022-32199 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •