Read the docs

Schiocco

Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Schiocco records in CISA KEV

No Schiocco vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Support Board 6 records MEDIUM Support Board - Chat And Help Desk 2 records MEDIUM

Records

6 records in Support Board · all components

TI-2025-04323 CVE-2025-4828 · GHSA-qq5f-j4wf-xqm8

Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion

Priority MEDIUM 51

The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00964 Published 2025-07-08 No fix listed CWE-22
TI-2025-04348 CVE-2025-4855 · GHSA-vv4w-9vmx-jmwp

Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key

Priority MEDIUM 49

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00385 Published 2025-07-08 No fix listed CWE-639
TI-2026-04199 CVE-2026-4815 · GHSA-4wj4-5pg3-mprq

SQL Injection vulnerability in Support Board

Priority MEDIUM 46

A SQL Injection vulnerability has been found in Support Board v3.7.7.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00376 Published 2026-03-25 Fixed in 3.7.8 CWE-89
TI-2021-07105 CVE-2021-24823 · GHSA-v252-c336-2rvr

Support Board < 3.3.6 - Arbitrary File Deletion via CSRF

Priority LOW 36

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0055 Published 2022-02-28 Fixed in 3.3.6 CWE-352
TI-2021-07089 CVE-2021-24807 · GHSA-g623-mj4w-fprv

Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting

Priority LOW 27

The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to t…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01417 Published 2021-11-08 Fixed in 3.3.5 CWE-79
Open these records in search →