Schiocco
8 CVEs across 3 Schiocco products. Browse Schiocco vulnerabilities, severities, and proof-of-concept exploits.
Schiocco products with known CVEs
Schiocco CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-27395 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions. |
CVE-2026-4816 | Medium | 5.4 | 2026-03-25 | A Reflected Cross Site Scripting (XSS) vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to execute JavaScript code i… |
CVE-2026-4815 | High | 8.8 | 2026-03-25 | A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via… |
CVE-2025-60182 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS… |
CVE-2025-54031 | High | 8.1 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard al… |
CVE-2025-54027 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS… |
CVE-2025-4855 | Critical | 9.8 | 2025-07-09 | The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_enc… |
CVE-2025-4828 | Critical | 9.8 | 2025-07-09 | The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all… |
CVE-2021-24823 | High | 8.1 | 2022-02-28 | The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to m… |
CVE-2021-24807 | Medium | 5.4 | 2021-11-08 | The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes f… |
CVE-2021-24741 | Critical | 9.8 | 2021-09-20 | The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversati… |
CVE-2018-18373 | Medium | 5.4 | 2018-10-17 | In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Cha… |