彙總 scriptcase 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
已披露問題常與 跨站腳本與路徑處理缺陷 相關，可能在 軟體部署與生產負載 場景中帶來 工作階段劫持與檔案覆寫 等暴露風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-47228 | In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests. | [email protected] | 6.7 | 14.44% | 2025-07-04 | 2026-06-17 |
| CVE-2025-47227 | In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover. | [email protected] | 7.5 | 1.96% | 2025-07-04 | 2026-06-17 |
| CVE-2024-46084 | Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function. | [email protected] | 8.0 | 0.78% | 2024-10-01 | 2026-06-17 |
| CVE-2024-46082 | Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters. | [email protected] | 5.4 | 0.29% | 2024-10-01 | 2026-06-17 |
| CVE-2024-46080 | Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function. | [email protected] | 8.0 | 0.73% | 2024-10-01 | 2026-06-17 |
| CVE-2024-46083 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user's account on the platform. It is important to note that regular users can trigger actions for administrator users. | [email protected] | 5.4 | 0.27% | 2024-10-01 | 2026-06-17 |
| CVE-2024-46081 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-Do List. The assigned user will trigger a stored XSS, which is particularly dangerous because tasks are assigned to various users on the platform. | [email protected] | 5.4 | 0.30% | 2024-10-01 | 2026-06-17 |
| CVE-2024-46079 | Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter. | [email protected] | 6.1 | 0.32% | 2024-10-01 | 2026-06-17 |
| CVE-2024-8942 | Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_title” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their credentials. | [email protected] | 6.3 | 0.32% | 2024-09-24 | 2026-06-17 |
| CVE-2024-8941 | Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a path used in the POST parameter “field_file” by a web application. | [email protected] | 7.5 | 0.60% | 2024-09-24 | 2026-06-17 |
| CVE-2024-8940 | Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input. | [email protected] | 10.0 | 0.53% | 2024-09-24 | 2026-06-17 |
| CVE-2022-32199 | db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. | [email protected] | 6.5 | 1.66% | 2023-03-27 | 2026-06-17 |