Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Schiocco Component: Support Board Clear all filters
TI-2026-04199 CVE-2026-4815 · GHSA-4wj4-5pg3-mprq

SQL Injection vulnerability in Support Board

Priority MEDIUM 46

A SQL Injection vulnerability has been found in Support Board v3.7.7.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00376 Published 2026-03-25 Fixed in 3.7.8 CWE-89
TI-2025-04348 CVE-2025-4855 · GHSA-vv4w-9vmx-jmwp

Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key

Priority MEDIUM 49

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00385 Published 2025-07-08 No fix listed CWE-639
TI-2025-04323 CVE-2025-4828 · GHSA-qq5f-j4wf-xqm8

Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion

Priority MEDIUM 51

The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00964 Published 2025-07-08 No fix listed CWE-22
TI-2021-07105 CVE-2021-24823 · GHSA-v252-c336-2rvr

Support Board < 3.3.6 - Arbitrary File Deletion via CSRF

Priority LOW 36

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0055 Published 2022-02-28 Fixed in 3.3.6 CWE-352
TI-2021-07089 CVE-2021-24807 · GHSA-g623-mj4w-fprv

Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting

Priority LOW 27

The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to t…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01417 Published 2021-11-08 Fixed in 3.3.5 CWE-79