Newsscriptphp

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Newsscriptphp records in CISA KEV

No Newsscriptphp vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

4 records in News Script Php Pro · all components

TI-2020-15570 CVE-2020-25475 · GHSA-hpw3-822x-7j7j

MEDIUM 44

SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01065 Published 2020-11-24 No fix listed CWE-89

TI-2020-15568 CVE-2020-25473 · GHSA-rc6c-3j97-8gfm

LOW 31

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00915 Published 2020-11-24 No fix listed

TI-2020-15569 CVE-2020-25474 · GHSA-r23c-vx43-32vg

LOW 29

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00869 Published 2020-11-24 No fix listed CWE-79

TI-2020-15567 CVE-2020-25472 · GHSA-rrv5-9g7j-vq28

LOW 29

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00519 Published 2020-11-24 No fix listed CWE-352