Iscripts

Records30All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

Iscripts records in CISA KEV

No Iscripts vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Eswap 9 records MEDIUM Socialware 3 records LOW Autohoster 2 records LOW Easycreate 2 records LOW Multicart 2 records LOW Supportdesk 2 records LOW Uberforx 2 records LOW Cybermatch 1 record LOW

Records

9 records in Eswap · all components

TI-2018-08113 CVE-2018-11373 · GHSA-c3jx-983v-9r9w

iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.

MEDIUM 44

iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01161 Published 2018-05-22 No fix listed CWE-89

TI-2018-08112 CVE-2018-11372 · GHSA-c4g3-65gm-mv5p

iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.

MEDIUM 44

iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01161 Published 2018-05-22 No fix listed CWE-89

TI-2018-08194 CVE-2018-11470 · GHSA-gx8g-xrc3-7jcq

iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.

MEDIUM 40

iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01018 Published 2018-05-25 No fix listed CWE-89

TI-2018-07120 CVE-2018-10048 · GHSA-wvfm-cgxx-8pv9

iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.

LOW 39

iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00494 Published 2018-04-11 No fix listed CWE-352

TI-2010-04759 CVE-2010-5036 · GHSA-3r65-cwvq-rgv3

SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers…

LOW 35

SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01151 Published 2011-11-02 No fix listed CWE-89

TI-2018-07122 CVE-2018-10050 · GHSA-m6r3-34hc-496w

iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel.

LOW 34

iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01002 Published 2018-04-11 No fix listed CWE-89

TI-2018-07192 CVE-2018-10135 · GHSA-p7mf-vc62-59r5

iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.

LOW 28

iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00669 Published 2018-04-16 No fix listed CWE-79

TI-2010-04758 CVE-2010-5035 · GHSA-vc3m-m55j-xc82

Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows…

LOW 24

Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary web script or HTML via the txtHomeSearch parameter (aka the search field).

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01776 Published 2011-11-02 No fix listed CWE-79

TI-2018-07121 CVE-2018-10049 · GHSA-9hpj-2f3j-v6jf

iScripts eSwap v2.4 has XSS via the "registration_settings.php" txtDate parameter in the Admin Panel.

LOW 23

iScripts eSwap v2.4 has XSS via the "registration_settings.php" txtDate parameter in the Admin Panel.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00529 Published 2018-04-11 No fix listed CWE-79

Open these records in search →