Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
238 results · page 3 of 5
Apr 1, 2025Awesome Support – WordPress HelpDesk & Support: Sensitive Information ExposureCVE-2024-13567 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 7, 2025An improper certificate validation vulnerability has been reported to affect Helpdesk.CVE-2024-50394 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: Helpdesk 3.3.3 and later
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025SupportCandy – Helpdesk & Customer Support Ticket System: Insecure Direct Object ReferenceCVE-2024-13552 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it possible for authenticated attackers to download attachments for support tickets that don't belong to them. If an admin enables tickets for guests, this can be exploited by unauthenticated attackers.
- Product
- SupportCandy – Helpdesk & Customer Support Ticket System
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update SupportCandy – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 1, 2025Fluent Support – Helpdesk & Customer Support Ticket System: Sensitive Information ExposureCVE-2024-13568 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attachments included in support tickets.
- Product
- Fluent Support – Helpdesk & Customer Support Ticket System
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update Fluent Support – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 26, 2025A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by iCVE-2024-46226 · Other software · Helpdeskz · reported by MITREMedium 4.8
A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket.
- Product
- Helpdeskz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jan 31, 2025ELEX WordPress HelpDesk & Customer Ticketing System: Privilege escalationCVE-2024-12171 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts.
- Product
- ELEX WordPress HelpDesk & Customer Ticketing System
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 21, 2025In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integrationCVE-2025-24458 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22762 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Stored XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.
- Product
- WordPress HelpDesk & Support Ticket System Plugin – Octrace Support
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Request Forgery (CSRF) via the WSCView function.CVE-2023-42234 · Other software · Zucchetti · reported by MITREMedium 5.4
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Request Forgery (CSRF) via the WSCView function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the Filter/FilterEditor function.CVE-2023-42233 · Other software · Zucchetti · reported by MITREMedium 6.1
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the Filter/FilterEditor function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index function.CVE-2023-42232 · Other software · Zucchetti · reported by MITREHigh 7.5
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control.CVE-2023-42231 · Other software · Zucchetti · reported by MITREHigh 8.1
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users by sending a request to the "WSCView/Delete" function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the WSCView/Save function.CVE-2023-42230 · Other software · Zucchetti · reported by MITREMedium 6.1
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the WSCView/Save function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal.CVE-2023-42229 · Other software · Zucchetti · reported by MITREMedium 6.5
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal. Arbitrary files can be created on the system via authenticated SOAP requests to the WSConnector service.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control.CVE-2023-42228 · Other software · Zucchetti · reported by MITREHigh 8.8
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a request to the "AclList/SaveAclRules" administrative function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function.CVE-2023-42227 · Other software · Zucchetti · reported by MITREHigh 7.5
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function.CVE-2023-42226 · Other software · Zucchetti · reported by MITREHigh 7.5
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function.CVE-2023-42225 · Other software · Zucchetti · reported by MITREHigh 7.5
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout: Stored Cross-Site ScriptingCVE-2024-12443 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'crm-perks-tickets' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2024WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54274 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Reflected XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.
- Product
- WordPress HelpDesk & Support Ticket System Plugin – Octrace Support
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WordPress HelpDesk & Support Ticket System Plugin – Octrace Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to CVE-2023-52268 · Other software · freescout_helpdesk · reported by MITRECritical 9.1
The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfreescout.netfreescout.net
Nov 1, 2024An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject aCVE-2024-51377 · Other software · ladybirdweb · reported by MITREMedium 5.4
An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields
- Product
- faveo_helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionalityCVE-2024-50574 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to execute arbitrary coCVE-2024-46482 · Other software · ladybirdweb · reported by MITREHigh 8.2
An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .html or .svg file.
- Product
- faveo_helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into theCVE-2024-46639 · Other software · evolutionscript · reported by MITREHigh 7.6
A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.
- Product
- helpdeskz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 6, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk.CVE-2024-27125 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 3.5
A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following version: Helpdesk 3.3.1 and later
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allowsCVE-2024-34992 · Websites & servers · prestashop · reported by MITREHigh 8.8
SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via 'Tickets::getsearchedtickets()'
- Product
- helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Jun 19, 2024In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files.CVE-2024-34990 · Websites & servers · prestashop · reported by MITRECritical 10
In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontController::replyTicket()` allow upload of .php files on a predictable path for connected customers.
- Product
- helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024FreeScout is a free, self-hosted help desk and shared mailbox.CVE-2024-34698 · Other software · freescout-helpdesk · reported by GitHubMedium 4.6
FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/public/js/main.js` source file. The Prototype Pollution arises because the `getQueryParam` Function recursively merges an object containing user-controllable properties into an existing object (For URL Query Parameters Parsing), without first sanitizing the keys. This can allow an attacker to inject a property with a key `__proto__`, along with arbitrarily nested properties. The merge operation assigns the nested properties to the `params` object's prototype instead of the target object itself. As a result, the attacker can pollute the prototype with properties containing harmful values, which are then inherited by user-defined objects and subsequently used by the application dangerously. The vulnerability lets an attacker control properties of objects that would otherwise be inaccessible. If the application subsequently handles an attacker-controlled property in an unsafe way, this can potentially be chained with other vulnerabilities like DOM-based XSS, Open Redirection, Cookie Manipulation, Link Manipulation, HTML Injection, e
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024FreeScout is a free, self-hosted help desk and shared mailbox.CVE-2024-34697 · Other software · freescout-helpdesk · reported by GitHubHigh 7.6
FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Freescout Application. The vulnerability allows attackers to inject malicious HTML content into emails sent to the application's mailbox. This vulnerability arises from improper handling of HTML content within incoming emails, allowing attackers to embed malicious HTML code in the context of the application's domain. Unauthenticated attackers can exploit this vulnerability to inject malicious HTML content into emails. This could lead to various attacks such as form hijacking, application defacement, or data exfiltration via CSS injection. Although unauthenticated attackers are limited to HTML injection, the consequences can still be severe. Version 1.8.139 implements strict input validation and sanitization mechanisms to ensure that any HTML content received via emails is properly sanitized to prevent malicious HTML injections.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024FreeScout is a self-hosted help desk and shared mailbox.CVE-2024-29185 · Other software · freescout-helpdesk · reported by GitHubCritical 9
FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the php_path parameter is being executed as an OS command by the shell_exec function, without validating it. This allows an adversary to execute malicious OS commands on the server. A practical demonstration of the successful command injection attack extracted the /etc/passwd file of the server. This represented the complete compromise of the server hosting the FreeScout application. This attack requires an attacker to know the `App_Key` of the application. This limitation makes the Attack Complexity to be High. If an attacker gets hold of the `App_Key`, the attacker can compromise the Complete server on which the application is deployed. Version 1.8.128 contains a patch for this issue.
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024FreeScout is a self-hosted help desk and shared mailbox.CVE-2024-29184 · Other software · freescout-helpdesk · reported by GitHubHigh 8
FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. In this case, the Support Agent User can inject malicious scripts into their signature, which will then be executed when viewed by the Administrator. The application protects users against XSS attacks by enforcing a CSP policy, the CSP Policy is: `script-src 'self' 'nonce-abcd' `. The CSP policy only allows the inclusion of JS files that are present on the application server and doesn't allow any inline script or script other than nonce-abcd. The CSP policy was bypassed by uploading a JS file to the server by a POST request to /conversation/upload endpoint. After this, a working XSS payload was crafted by including the uploaded JS file link as the src of the script. This bypassed the CSP policy and XSS attacks became possible. The impact of this vulnerability is sever
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024FreeScout is an open source help desk and shared inbox built with PHP.CVE-2024-28186 · Other software · freescout-helpdesk · reported by GitHubHigh 7.1
FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing complete stack traces of exceptions in its database. The sensitive information is then inadvertently disclosed to users via the `/conversation/ajax-html/send_log?folder_id=&thread_id={id}` endpoint. The stack trace reveals value of parameters, including the username and password, passed to the `Swift_Transport_Esmtp_Auth_LoginAuthenticator->authenticate()` function. Exploiting this vulnerability allows an attacker to gain unauthorized access to SMTP server credentials. With this sensitive information in hand, the attacker can potentially send unauthorized emails from the compromised SMTP server, posing a severe threat to the confidentiality and integrity of email communications. This could lead to targeted attacks on both the application users and the organization itself, compromising the security of email exchange servers. This issue has been addressed in version 1.8.124. Users are advised
- Product
- freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2024In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possibleCVE-2024-28228 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 1, 2024A Cross-Site Scripting (XSS) vulnerability has been found in HelpDeskZ affecting version 2.0.2 and earlier.CVE-2024-2078 · Other software · HelpDeskZ · reported by cve-coordination@incibe.esMedium 4.6
A Cross-Site Scripting (XSS) vulnerability has been found in HelpDeskZ affecting version 2.0.2 and earlier. This vulnerability could allow an attacker to send a specially crafted JavaScript payload within the email field and partially take control of an authenticated user's browser session.
- Product
- HelpDeskZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2024Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescoutCVE-2024-1932 · Other software · freescout-helpdesk · reported by security@huntr.devMedium 4.8
Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout
- Product
- freescout-helpdesk/freescout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2024Awesome Support – WordPress HelpDesk & Support: Unauthorized access of dataCVE-2024-0596 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the editor_html() function in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view password protected and draft posts. CVE-2024-35741 is likely a duplicate of this issue.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.1.7
- What to do
- Affects up to 6.1.7. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 10, 2024Awesome Support – WordPress HelpDesk & Support: Unauthorized accessCVE-2024-0595 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpas_get_users() function hooked via AJAX in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve user data such as emails. CVE-2024-35741 is likely a duplicate of this issue.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.1.7
- What to do
- Affects up to 6.1.7. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 10, 2024Awesome Support – WordPress HelpDesk & Support: Union-based SQL InjectionCVE-2024-0594 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parameter of the wpas_get_users action in all versions up to, and including, 6.1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.1.7
- What to do
- Affects up to 6.1.7. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2024Awesome Support – WordPress HelpDesk & Support: Cross-Site Request Forgery (CSRF)CVE-2023-51538 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.5.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.1.5
- What to do
- Affects up to 6.1.5. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 31, 2023Fluent Support – WordPress Helpdesk and Customer Support Ticket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-51547 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin.This issue affects Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin: from n/a through 1.7.6.
- Product
- Fluent Support – WordPress Helpdesk and Customer Support Ticket
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update Fluent Support – WordPress Helpdesk and Customer Support Ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Awesome Support – WordPress HelpDesk & Support: Cross-Site Request Forgery (CSRF)CVE-2023-48323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross Site Request Forgery.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.4.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.1.4
- What to do
- Affects up to 6.1.4. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2023In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk formsCVE-2023-38068 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jun 23, 2023Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application.CVE-2023-1724 · Other software · Ladybirdweb · reported by help@fluidattacks.comHigh 7.3
Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS.
- Product
- Faveo Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jun 12, 2023In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk formsCVE-2023-35053 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 24, 2023Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection.CVE-2023-25350 · Other software · Ladybirdweb · reported by MITREHigh 8.8
Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection.
- Product
- Faveo Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 15, 2022A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0.CVE-2022-29517 · Other software · Lansweeper · reported by talos-cna@cisco.comCritical 9.9
A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- lansweeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 13, 2022A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a cCVE-2022-31400 · Other software · Helpdeskz · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field.
- Product
- Helpdeskz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2022-31398 · Other software · Helpdeskz · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field.
- Product
- Helpdeskz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.CVE-2022-22149 · Other software · Lansweeper · reported by talos-cna@cisco.comHigh 8.8
A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- lansweeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comlansweeper.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.