Scriptcase is a web application development platform whose vulnerability profile centers on input handling and code generation across its single core product. The recurring weakness classes—cross-site scripting, path traversal, code injection, command injection, and unrestricted file uploads—reflect the typical attack surface of a rapid-development framework where user-supplied content flows through code generation and template rendering. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Scriptcase over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-8940CRITICAL Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/p | Sep 25, 2024 | 9.8 | 28 | NO | NO |
CVE-2024-46084HIGH Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function. | Oct 1, 2024 | 8.0 | 24 | NO | NO |
CVE-2022-32199MEDIUM db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. | Mar 27, 2023 | 6.5 | 23 | NO | NO |
CVE-2024-46080HIGH Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function. | Oct 1, 2024 | 8.0 | 22 | NO | NO |
CVE-2024-8942HIGH Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_title” parameter, among o | Sep 25, 2024 | 8.2 | 20 | NO | NO |
CVE-2024-46079MEDIUM Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter. | Oct 1, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-46082MEDIUM Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters. | Oct 1, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-46083MEDIUM Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, which allows the injecti | Oct 1, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-46081MEDIUM Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned user will trigger a | Oct 1, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-8941MEDIUM Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users | Sep 25, 2024 | 5.3 | 16 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Scriptcase.
Media articles that mention a CVE ID that affects a product developed by Scriptcase — matched by CVE ID, not by vendor name.