4174 matches found
EUVD-2026-51422
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...
CVE-2026-14929: Incorrect Authorization
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...
CVE-2026-15209: Authorization Bypass Through User-Controlled Key
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...
CVE-2026-14931: Exposure of Sensitive Information to an Unauthorized Actor
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...
PT-2026-66710
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...
CVE-2026-14928: Exposure of Sensitive Information to an Unauthorized Actor
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...
PT-2026-66711
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...
CVE-2026-14930: Missing Authorization
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions and attach them to...
Malicious code in unified-help-center-alpha (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a76f48c6cd4bfeda98c49e3c091e319501f5566227f6ad6cdb654c193fbe7582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11406 Malicious code in unified-help-center-alpha (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a76f48c6cd4bfeda98c49e3c091e319501f5566227f6ad6cdb654c193fbe7582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview unified-help-center-alpha is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CVE-2026-28323
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled...
CVE-2026-28323
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled...
CVE-2026-28323 SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled...
CVE-2026-28323
CVE-2026-28323 affects SolarWinds Web Help Desk with a SAML authentication bypass when SAML 2.0 is enabled. The NVD/NVD-derived metadata lists CVSS v3.1 base score 9.8 (CRITICAL) with network access, low attack complexity, no privileges, and high impact to confidentiality, integrity, and availabi...
CVE-2026-28323 SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled...
EUVD-2026-51182
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled...
CVE-2026-28323: Improper Authentication
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled...
PT-2026-66511
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk affected versions not specified Description An authentication bypass exists when the SAML 2.0 authentication method is enabled. The application treats SAML signature verification as optional and skips required validati...
