Vulnerabilities

TI-2020-15570 CVE-2020-25475 · GHSA-hpw3-822x-7j7j

SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action.

MEDIUM 44

SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01065 Published 2020-11-24 No fix listed CWE-89

TI-2020-15569 CVE-2020-25474 · GHSA-r23c-vx43-32vg

LOW 29

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00869 Published 2020-11-24 No fix listed CWE-79

TI-2020-15568 CVE-2020-25473 · GHSA-rc6c-3j97-8gfm

LOW 31

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00915 Published 2020-11-24 No fix listed

TI-2020-15567 CVE-2020-25472 · GHSA-rrv5-9g7j-vq28

LOW 29

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00519 Published 2020-11-24 No fix listed CWE-352