Iscripts

Records30All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

Iscripts records in CISA KEV

No Iscripts vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Eswap 9 records MEDIUM Socialware 3 records LOW Autohoster 2 records LOW Easycreate 2 records LOW Multicart 2 records LOW Supportdesk 2 records LOW Uberforx 2 records LOW Cybermatch 1 record LOW

Records

30 records

TI-2019-15534 CVE-2019-25481 · GHSA-28wh-pr48-2cq7

iScripts ReserveLogic Lastest SQL Injection via search endpoint

HIGH 77

iScripts ReserveLogic contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the jqSearchDestination parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0037 Published 2026-03-12 No fix listed CWE-89

TI-2018-08113 CVE-2018-11373 · GHSA-c3jx-983v-9r9w

iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.

MEDIUM 44

iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01161 Published 2018-05-22 No fix listed CWE-89

TI-2018-08112 CVE-2018-11372 · GHSA-c4g3-65gm-mv5p

iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.

MEDIUM 44

iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01161 Published 2018-05-22 No fix listed CWE-89

TI-2018-08194 CVE-2018-11470 · GHSA-gx8g-xrc3-7jcq

iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.

MEDIUM 40

iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01018 Published 2018-05-25 No fix listed CWE-89

TI-2018-07194 CVE-2018-10137 · GHSA-xv98-phv8-7vq2

iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via…

LOW 39

iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage_settings&action=edit URI.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00494 Published 2018-04-16 No fix listed CWE-352

TI-2018-07120 CVE-2018-10048 · GHSA-wvfm-cgxx-8pv9

iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.

LOW 39

iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00494 Published 2018-04-11 No fix listed CWE-352

TI-2010-04703 CVE-2010-4980 · GHSA-3mp4-xvjw-xm88

SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows…

LOW 37

SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02359 Published 2011-11-01 No fix listed CWE-89

TI-2013-05879 CVE-2013-7189 · GHSA-cjhq-x52v-8f3r

Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote…

LOW 35

Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrary SQL commands via the cmbdomain parameter to (1) checktransferstatus.php, (2) checktransferstatusbck…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01264 Published 2013-12-20 No fix listed CWE-89

TI-2010-04759 CVE-2010-5036 · GHSA-3r65-cwvq-rgv3

SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers…

LOW 35

SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01151 Published 2011-11-02 No fix listed CWE-89

TI-2010-04757 CVE-2010-5034 · GHSA-7p8m-c4x2-3gjg

SQL injection vulnerability in viewhistorydetail.php in iScripts EasyBiller 1.1 allows…

LOW 35

SQL injection vulnerability in viewhistorydetail.php in iScripts EasyBiller 1.1 allows remote attackers to execute arbitrary SQL commands via the planid parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01151 Published 2011-11-02 No fix listed CWE-89

TI-2010-04706 CVE-2010-4983 · GHSA-94gx-xmmj-98qj

SQL injection vulnerability in profile.php in iScripts CyberMatch 1.0 allows remote…

LOW 35

SQL injection vulnerability in profile.php in iScripts CyberMatch 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01189 Published 2011-11-01 No fix listed CWE-89

TI-2010-02729 CVE-2010-2853 · GHSA-pqg3-798q-wvr8

SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows…

LOW 35

SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arbitrary SQL commands via the product_id parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01189 Published 2010-07-23 No fix listed CWE-89

TI-2010-02514 CVE-2010-2624 · GHSA-mqmf-7h6w-h2r4

Multiple SQL injection vulnerabilities in iScripts EasySnaps 2.0 allow remote attackers…

LOW 35

Multiple SQL injection vulnerabilities in iScripts EasySnaps 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) comment parameter to add_comments.php, (2) values parameter to tags_details.php, or (3…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0115 Published 2010-07-02 No fix listed CWE-89

TI-2008-04000 CVE-2008-4169 · GHSA-g5cg-2mj2-5gf4

SQL injection vulnerability in detaillist.php in iScripts EasyIndex, possibly 1.0, allows…

LOW 35

SQL injection vulnerability in detaillist.php in iScripts EasyIndex, possibly 1.0, allows remote attackers to execute arbitrary SQL commands via the produid parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01042 Published 2008-09-22 No fix listed CWE-89

TI-2008-01786 CVE-2008-1859 · GHSA-v47g-rq9v-p4vr

SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers…

LOW 35

SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01042 Published 2008-04-16 No fix listed CWE-89

TI-2018-07122 CVE-2018-10050 · GHSA-m6r3-34hc-496w

iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel.

LOW 34

iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01002 Published 2018-04-11 No fix listed CWE-89

TI-2018-06688 CVE-2018-9235 · GHSA-m9vr-mjm4-q4jh

iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.

LOW 32

iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02466 Published 2018-04-04 No fix listed CWE-79

TI-2007-05066 CVE-2007-5261 · GHSA-fm4v-7qrr-j4j9

Multiple SQL injection vulnerabilities in MultiCart 1.0 allow remote attackers to execute…

LOW 32

Multiple SQL injection vulnerabilities in MultiCart 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter to categorydetail.php and the (2) ddlCategory parameter to search.php.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.01996 Published 2007-10-06 No fix listed CWE-89

TI-2008-01717 CVE-2008-1790 · GHSA-7r8h-pf5c-m2pr

Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated…

LOW 31

Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbitrary files via a crafted logo file in the "Manage Settings" functionality.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01084 Published 2008-04-15 No fix listed CWE-264

TI-2008-00875 CVE-2008-0911 · GHSA-884f-qmw7-8v2m

SQL injection vulnerability in productdetails.php in iScripts MultiCart 2.0 allows remote…

LOW 30

SQL injection vulnerability in productdetails.php in iScripts MultiCart 2.0 allows remote authenticated users to execute arbitrary SQL commands via the productid parameter.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.00856 Published 2008-02-22 No fix listed CWE-89

TI-2013-05880 CVE-2013-7190 · GHSA-w437-c847-qhr7

Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow…

LOW 29

Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (2) fname parameter t…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03605 Published 2013-12-20 No fix listed CWE-22

TI-2018-07193 CVE-2018-10136 · GHSA-w388-cjfq-j43f

iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel…

LOW 28

iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settings&action=edit URI.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00669 Published 2018-04-16 No fix listed CWE-79

TI-2018-07192 CVE-2018-10135 · GHSA-p7mf-vc62-59r5

iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.

LOW 28

iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00669 Published 2018-04-16 No fix listed CWE-79

TI-2018-06690 CVE-2018-9237 · GHSA-c2gh-mqcp-5944

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.

LOW 28

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0178 Published 2018-04-04 No fix listed CWE-79

TI-2018-06689 CVE-2018-9236 · GHSA-mc3p-x457-mf49

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.

LOW 28

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0178 Published 2018-04-04 No fix listed CWE-79

Open these records in search →