EUVD-2023-12658

Malicious code in bioql PyPI...

EUVD-2023-12762

Malicious code in bioql PyPI...

EUVD-2023-12253

Malicious code in bioql PyPI...

CVE-2024-48392

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting XSS. An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover...

CVE-2023-0738

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html...

CVE-2024-48392

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting XSS. An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover...

CVE-2024-48392

OrangeScrum version v2.0.11 is vulnerable to a Cross-Site Scripting (XSS) flaw in both its self-hosted and premium versions. The root cause is a lack of effective filtering, escaping, and input validation of user-supplied data, specifically within the user email functionality. An attacker can exp...

CVE-2024-48392

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting XSS. An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover...

Exploit for CVE-2024-48392

CVE-2024-48392 Exploit Overview This rep...

CVE-2023-0738

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html...

CVE-2023-0164

OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function...