eswap vulnerabilities and fixes

Recent CVEs affecting eswap, with upgrade or downgrade steps. 7 tracked.

eswap has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-05-25. Highest priority: CVE-2018-11373 (score 61/100).

• CVE-2018-11470 HIGH 8.8 DOWNGRADE iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.
• CVE-2018-11373 CRITICAL 9.8 DOWNGRADE iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.
• CVE-2018-11372 CRITICAL 9.8 DOWNGRADE iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.
• CVE-2018-10135 MEDIUM 6.1 DOWNGRADE iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.
• CVE-2018-10050 HIGH 7.2 DOWNGRADE iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel
• CVE-2018-10049 MEDIUM 4.8 DOWNGRADE iScripts eSwap v2.4 has XSS via the "registration_settings.php" txtDate parameter in the Admin Panel.
• CVE-2018-10048 HIGH 8.8 DOWNGRADE iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.

FAQ

How do I fix eswap vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is eswap being exploited right now?

None of the tracked eswap CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which eswap CVE should I patch first?

CVE-2018-11373 currently ranks highest (61/100): iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter..

RSS feed for eswap · ← Back to latest CVEs