PatchTheCVEiscripts vulnerabilities
Recent CVEs affecting iscripts products. 14 tracked.
iscripts has 14 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-05-25. Highest priority: CVE-2018-11373 (score 61/100).
- CVE-2018-9237 MEDIUM 5.4 DOWNGRADE iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
- CVE-2018-9236 MEDIUM 5.4 DOWNGRADE iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.
- CVE-2018-9235 MEDIUM 6.1 DOWNGRADE iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.
- CVE-2018-11470 HIGH 8.8 DOWNGRADE iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.
- CVE-2018-11373 CRITICAL 9.8 DOWNGRADE iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.
- CVE-2018-11372 CRITICAL 9.8 DOWNGRADE iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.
- CVE-2018-10137 HIGH 8.8 DOWNGRADE iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage
- CVE-2018-10136 MEDIUM 6.1 DOWNGRADE iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to
- CVE-2018-10135 MEDIUM 6.1 DOWNGRADE iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.
- CVE-2018-10052 MEDIUM 4.8 DOWNGRADE iScripts SupportDesk v4.3 has XSS via the admin/inteligentsearchresult.php txtinteligentsearch parameter.
- CVE-2018-10051 MEDIUM 5.4 DOWNGRADE iScripts SupportDesk v4.3 has XSS via the staff/inteligentsearchresult.php txtinteligentsearch parameter.
- CVE-2018-10050 HIGH 7.2 DOWNGRADE iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel
- CVE-2018-10049 MEDIUM 4.8 DOWNGRADE iScripts eSwap v2.4 has XSS via the "registration_settings.php" txtDate parameter in the Admin Panel.
- CVE-2018-10048 HIGH 8.8 DOWNGRADE iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.
FAQ
How do I fix iscripts vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is iscripts being exploited right now?
None of the tracked iscripts CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which iscripts CVE should I patch first?
CVE-2018-11373 currently ranks highest (61/100): iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter..