Helpbox
Vendor:
First CVE: Dec 31, 2004 · Active for 21 years
11
Total CVEs
Bottom 1%
3.7
Avg CVEs / Year
Bottom 1%
5.6
Avg CVSS
Higher Avg CVSS than 29% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Helpbox over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2004
21 years ago
Most Recent CVE
Dec 12, 2012
4,974 days ago
CVE Severity & Scoring
Helpbox11 CVEs
9%
73%
18%
All CVEs352,708 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown11 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown11 (100.0%)
User Interaction
None0 (0.0%)
Unknown11 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown11 (100.0%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2004-2551HIGH Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the sys_comment_id parameter in editcommentenduser.a | Dec 31, 2004 | 7.5 | 28 | NO | YES |
CVE-2012-4971HIGH Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) reqclass parameter to editrequestenduser.asp; th | Dec 12, 2012 | 7.5 | 22 | NO | NO |
CVE-2012-4974MEDIUM Layton Helpbox 4.4.0 allows remote authenticated users to change the login context and gain privileges via a modified (1) loggedinenduser, (2) loggedinendusername, (3) loggedinuser | Dec 12, 2012 | 6.5 | 20 | NO | NO |
CVE-2012-4972MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) sys_solution_id, (2) sys_reque | Dec 12, 2012 | 4.3 | 18 | NO | NO |
CVE-2012-4977MEDIUM Layton Helpbox 4.4.0 allows remote attackers to discover cleartext credentials for the login page by sniffing the network. | Dec 12, 2012 | 5.0 | 17 | NO | NO |
CVE-2012-4976MEDIUM selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover ODBC database credentials via an element=sys_asset_id request, which is not properly handled during co | Dec 12, 2012 | 5.0 | 17 | NO | NO |
CVE-2007-5401MEDIUM Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not prop | Jan 9, 2008 | 6.5 | 17 | NO | NO |
CVE-2007-5402MEDIUM Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1) remote attackers to execute arbitrary SQL commands via the sys_request_id parameter to editrequestenduser.a | Jan 9, 2008 | 6.5 | 17 | NO | NO |
CVE-2012-4975MEDIUM editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sys_request_id parameter. | Dec 12, 2012 | 4.0 | 16 | NO | NO |
CVE-2007-5404MEDIUM Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usern | Jan 9, 2008 | 5.0 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
9.1% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Helpbox
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.4.0 | 6 | 5.4 | 1.1% | 0 | 0 |
| 3.7.1 | 4 | 5.4 | 1.1% | 0 | 0 |
| 3.0.1 | 1 | 7.5 | 2.3% | 0 | 1 |