Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Orangescrum Component: Orangescrum Clear all filters
TI-2021-22333 CVE-2021-47716 · GHSA-7w8f-3hpw-236x

Orangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpoints

Priority MEDIUM 56

Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00236 Published 2025-12-23 No fix listed CWE-79
TI-2021-22337 CVE-2021-47720 · GHSA-w28c-2qxg-pf3q

Orangescrum 1.8.0 Authenticated SQL Injection via Multiple Parameters

Priority HIGH 71

Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable parameters.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00326 Published 2025-12-23 No fix listed CWE-89
TI-2023-00700 CVE-2023-0738 · GHSA-r6wr-pw22-2qqc

Cross-site scripting in OrangeScrum

Priority MEDIUM 60

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-04-04 No fix listed CWE-79
TI-2023-00591 CVE-2023-0624 · GHSA-jh27-8mvh-57qm

Cross-site scripting in OrangeScrum

Priority MEDIUM 60

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-02-09 No fix listed CWE-79
TI-2023-00429 CVE-2023-0454 · GHSA-8grr-jg9f-p7h5

Path traversal in OrangeScrum

Priority HIGH 70

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00986 Published 2023-02-01 No fix listed CWE-22
TI-2023-00158 CVE-2023-0164 · GHSA-qwfh-7v4c-5cqf

OS command injection in OrangeScrum

Priority HIGH 79

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0142 Published 2023-01-18 No fix listed CWE-78