Read the docs

Orangescrum

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Orangescrum records in CISA KEV

No Orangescrum vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Orangescrum 9 records HIGH

Records

9 records in Orangescrum · all components

TI-2023-00158 CVE-2023-0164 · GHSA-qwfh-7v4c-5cqf

OS command injection in OrangeScrum

Priority HIGH 79

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0142 Published 2023-01-18 No fix listed CWE-78
TI-2021-22337 CVE-2021-47720 · GHSA-w28c-2qxg-pf3q

Orangescrum 1.8.0 Authenticated SQL Injection via Multiple Parameters

Priority HIGH 71

Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable parameters.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00326 Published 2025-12-23 No fix listed CWE-89
TI-2023-00429 CVE-2023-0454 · GHSA-8grr-jg9f-p7h5

Path traversal in OrangeScrum

Priority HIGH 70

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00986 Published 2023-02-01 No fix listed CWE-22
TI-2023-00700 CVE-2023-0738 · GHSA-r6wr-pw22-2qqc

Cross-site scripting in OrangeScrum

Priority MEDIUM 60

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-04-04 No fix listed CWE-79
TI-2023-00591 CVE-2023-0624 · GHSA-jh27-8mvh-57qm

Cross-site scripting in OrangeScrum

Priority MEDIUM 60

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-02-09 No fix listed CWE-79
TI-2021-22333 CVE-2021-47716 · GHSA-7w8f-3hpw-236x

Orangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpoints

Priority MEDIUM 56

Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00236 Published 2025-12-23 No fix listed CWE-79
Open these records in search →