PT-2026-21854

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.206 Description FreeScout’s TokenAuth middleware generates authentication tokens using a predictable method: MD5user id + created at + APP KEY. These tokens are static and do not expire or rotate. If an attacker...

CVE-2024-34698

FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the /public/js/main.js source file. The Prototype Pollution arises because the getQueryParam Function recursively merges an object containing...

CVE-2024-34697

FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Freescout Application. The vulnerability allows attackers to inject malicious HTML content into emails sent to the application's mailbox. Th...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in the JDBC driver for Apache Hive

Summary Multiple vulnerabilities in the JDBC driver for Apache Hive that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2025-58163 DESCRIPTION: FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier...

PT-2025-114: Stored XSS in FreeScout

The vulnerability was identified in FreeScout, version 1.8.182. The discovered vulnerability allows an attacker to inject arbitrary HTML tags and JavaScript, leading to script execution in victims’ browsers and enabling social‑engineering attacks. Vulnerability status: Confirmed by vendor Date of...

The vulnerability of the /mailbox/{mailbox_id}/knowledge-base component of the Knowledge Base module of the FreeScout support service system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /mailbox/mailboxid/knowledge-base component of the Knowledge Base module of the FreeScout support service management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

The vulnerability of the /custom-fields/ajax module of the Custom Fields component in the FreeScout support service management system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /custom-fields/ajax module of the Custom Fields component in the FreeScout support service management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

The vulnerability of the OAuth and Social Login module of the support service management system FreeScout allows a hacker to perform an SSRF attack.

The vulnerability of the OAuth and Social Login module of the support service management system of FreeScout is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

The vulnerability of the /kanban/ajax component in the Kanban module of the Support Service Management system of FreeScout allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /kanban/ajax component in the Kanban module of the Support Service Management system of FreeScout is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of the Easy Digital Downloads module of the support service management system FreeScout allows a hacker to disclose protected information and cause a service failure.

The vulnerability of the Easy Digital Downloads module in the FreeScout support management system is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow an attacker to disclose protected information and cause service failures...

The vulnerability in the FreeScout support service’s script/help/{mailbox_id}/auth/{customer_id}/{hash}/{timestamp} allows a hacker to execute arbitrary code.

The vulnerability of the “/help/mailboxid/auth/customerid/hash/timestamp” scenario in the FreeScout support service management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

The vulnerability of the FreeScout support service management system, related to deficiencies in the deserialization mechanism, allows a hacker to execute arbitrary code.

The vulnerability of the FreeScout support service management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability in the /conversation/ajax scenario of the FreeScout support service allows a hacker to execute arbitrary code.

The vulnerability of the /conversation/ajax scenario in the FreeScout support service management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability in the /login script of the FreeScout support service allows a hacker to execute arbitrary code.

The vulnerability of the /login system of the FreeScout support service is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability in the FreeScout support service’s configuration script /app-settings/ldap/ajax allows a hacker to execute arbitrary code.

The vulnerability of the FreeScout support service’s configuration script /app-settings/ldap/ajax is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability in the /chat/ajax scenario of the FreeScout support service management system allows a hacker to execute arbitrary code.

The vulnerability of the /chat/ajax endpoint in the FreeScout support service management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability of the /thread/{id}/download-attachments component in the Extended Attachments module of the FreeScout support service system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /thread/id/download-attachments component in the Extended Attachments module of the FreeScout support service management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

The vulnerability of the /kanban/ajax component in the Kanban module of the Support Service Management system of FreeScout allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /kanban/ajax component in the Kanban module of the Support Service Management system of FreeScout is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability in the /app-settings/oauth component of the OAuth & Social Login module of the Support Service Management system of FreeScout allows a hacker to disclose sensitive information and cause service denial.

The vulnerability of the /app-settings/oauth component of the OAuth & Social Login module of the Support Service Management system of FreeScout is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to disclose sensitive...

The vulnerability in the script/help/{mailbox_id} of the FreeScout support service allows a hacker to execute arbitrary code.

The vulnerability of the FreeScout support service’s script/help/mailboxid mechanism is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...