iscripts vulnerabilities

Products

• eswap 9
• socialware 3
• autohoster 2
• easycreate 2
• multicart 2
• supportdesk 2
• uberforx 2
• cybermatch 1
• easybiller 1
• easyindex 1
• easysnaps 1
• reservelogic 1
• sonicbb 1
• visualcaster 1

Latest iscripts CVEs

Newest publication first · page 1 of 2

1. CVE-2018-11470 iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.

   Published 2018-05-25

   High·CVSS 8.8

   iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.

2. CVE-2018-11373 iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.

   Published 2018-05-22

   Critical·CVSS 9.8

   iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter.

3. CVE-2018-11372 iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.

   Published 2018-05-22

   Critical·CVSS 9.8

   iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter.

4. CVE-2018-10137 iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage_settings&action=edit URI.

   Published 2018-04-16

   High·CVSS 8.8

   iScripts UberforX 2.2 has CSRF in the "manage_settings" section of the Admin Panel via the /cms?section=manage_settings&action=edit URI.

5. CVE-2018-10136 iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settings&action=edit URI.

   Published 2018-04-16

   Medium·CVSS 6.1

   iScripts UberforX 2.2 has Stored XSS in the "manage_settings" section of the Admin Panel via a value field to the /cms?section=manage_settings&action=edit URI.

6. CVE-2018-10135 iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.

   Published 2018-04-16

   Medium·CVSS 6.1

   iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.

7. CVE-2018-10052 iScripts SupportDesk v4.3 has XSS via the admin/inteligentsearchresult.php txtinteligentsearch parameter.

   Published 2018-04-11

   Medium·CVSS 4.8

   iScripts SupportDesk v4.3 has XSS via the admin/inteligentsearchresult.php txtinteligentsearch parameter.

8. CVE-2018-10051 iScripts SupportDesk v4.3 has XSS via the staff/inteligentsearchresult.php txtinteligentsearch parameter.

   Published 2018-04-11

   Medium·CVSS 5.4

   iScripts SupportDesk v4.3 has XSS via the staff/inteligentsearchresult.php txtinteligentsearch parameter.

9. CVE-2018-10050 iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel.

   Published 2018-04-11

   High·CVSS 7.2

   iScripts eSwap v2.4 has SQL injection via the "registration_settings.php" ddlFree parameter in the Admin Panel.

10. CVE-2018-10049 iScripts eSwap v2.4 has XSS via the "registration_settings.php" txtDate parameter in the Admin Panel.

    Published 2018-04-11

    Medium·CVSS 4.8

    iScripts eSwap v2.4 has XSS via the "registration_settings.php" txtDate parameter in the Admin Panel.

11. CVE-2018-10048 iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.

    Published 2018-04-11

    High·CVSS 8.8

    iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.

12. CVE-2018-9235 iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.

    Published 2018-04-04

    Medium·CVSS 6.1 EPSS 2.5%

    iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.

13. CVE-2018-9236 iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.

    Published 2018-04-04

    Medium·CVSS 5.4 EPSS 1.8%

    iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.

14. CVE-2018-9237 iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.

    Published 2018-04-04

    Medium·CVSS 5.4 EPSS 1.8%

    iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.

15. CVE-2013-7190 Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (...

    Published 2013-12-20

    Medium·CVSS 5.0 EPSS 3.6%

    Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (2) fname parameter to admin/downloadfile.php, or (3) id parameter to support/adm...

16. CVE-2013-7189 Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrary SQL commands via the cmbdomain parameter to (1) checktransferstatus.php, (2) ch...

    Published 2013-12-20

    High·CVSS 7.5 EPSS 1.3%

    Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrary SQL commands via the cmbdomain parameter to (1) checktransferstatus.php, (2) checktransferstatusbck.php, or (3) additionalsettings.php; or (4) invno parameter...

17. CVE-2010-5035 Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary web script or HTML via the txtHomeSearch parameter (aka the search field). NOTE...

    Published 2011-11-02

    Medium·CVSS 4.3 EPSS 1.8%

    Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary web script or HTML via the txtHomeSearch parameter (aka the search field). NOTE: some of these details are obtained from third party information.

18. CVE-2010-5036 SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.

    Published 2011-11-02

    High·CVSS 7.5 EPSS 1.2%

    SQL injection vulnerability in addsale.php in iScripts eSwap 2.0 allows remote attackers to execute arbitrary SQL commands via the type parameter.

19. CVE-2010-5034 SQL injection vulnerability in viewhistorydetail.php in iScripts EasyBiller 1.1 allows remote attackers to execute arbitrary SQL commands via the planid parameter.

    Published 2011-11-02

    High·CVSS 7.5 EPSS 1.2%

    SQL injection vulnerability in viewhistorydetail.php in iScripts EasyBiller 1.1 allows remote attackers to execute arbitrary SQL commands via the planid parameter.

20. CVE-2010-4983 SQL injection vulnerability in profile.php in iScripts CyberMatch 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Published 2011-11-01

    High·CVSS 7.5 EPSS 1.2%

    SQL injection vulnerability in profile.php in iScripts CyberMatch 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

21. CVE-2010-4980 SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.

    Published 2011-11-01

    High·CVSS 7.5 EPSS 2.4%

    SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.

22. CVE-2010-2853 SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arbitrary SQL commands via the product_id parameter.

    Published 2010-07-25

    High·CVSS 7.5 EPSS 1.2%

    SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arbitrary SQL commands via the product_id parameter.

23. CVE-2010-2624 Multiple SQL injection vulnerabilities in iScripts EasySnaps 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) comment parameter to add_comments.php, (2) values parameter to tag...

    Published 2010-07-02

    High·CVSS 7.5 EPSS 1.2%

    Multiple SQL injection vulnerabilities in iScripts EasySnaps 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) comment parameter to add_comments.php, (2) values parameter to tags_details.php, or (3) begin parameter to greetings.php.

24. CVE-2008-4169 SQL injection vulnerability in detaillist.php in iScripts EasyIndex, possibly 1.0, allows remote attackers to execute arbitrary SQL commands via the produid parameter.

    Published 2008-09-22

    High·CVSS 7.5 EPSS 1.0%

    SQL injection vulnerability in detaillist.php in iScripts EasyIndex, possibly 1.0, allows remote attackers to execute arbitrary SQL commands via the produid parameter.

25. CVE-2008-1859 SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.

    Published 2008-04-16

    High·CVSS 7.5 EPSS 1.0%

    SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.