PatchTheCVEordermanagementscript vulnerabilities
Recent CVEs affecting ordermanagementscript products. 8 tracked.
ordermanagementscript has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-04-12. Highest priority: CVE-2017-17928 (score 61/100).
- CVE-2018-6934 HIGH 8.8 DOWNGRADE CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.
- CVE-2017-17930 HIGH 8.8 MITIGATE PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by mod
- CVE-2017-17929 MEDIUM 4.8 MITIGATE PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
- CVE-2017-17928 CRITICAL 9.8 MITIGATE PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.
- CVE-2017-17927 MEDIUM 5.3 MITIGATE PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information
- CVE-2017-17926 MEDIUM 5.3 MITIGATE PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remo
- CVE-2017-17925 MEDIUM 4.8 MITIGATE PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parame
- CVE-2017-17924 MEDIUM 5.3 MITIGATE PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information
FAQ
How do I fix ordermanagementscript vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ordermanagementscript being exploited right now?
None of the tracked ordermanagementscript CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ordermanagementscript CVE should I patch first?
CVE-2017-17928 currently ranks highest (61/100): PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter..