Skip to content
OpenAdvisories

Vendor

Orangescrum

4 known vulnerabilities.

Products

orangescrum 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2021-47716

    Orangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpoints

    Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters like 'projid', 'CS_message', and 'name' to execute arbit…

    Orangescrum orangescrum
  • Medium 6.5
    CVE-2023-1783

    OrangeScrum 2.0.11 - AWS Credentials Leak via PDF Rendering

    OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF.

    Orangescrum orangescrum