PT-2025-46: Insufficient authorization in FreeScout

The vulnerability was identified in FreeScout, versions v.1.8.173 and 1.8.174. The discovered vulnerability allows an attacker to access information or functionality that exceeds the privileges granted to the user because the application checks access rights incorrectly. Vulnerability status:...

PT-2025-57: Stored XSS leads to CSRF in FreeScout

The vulnerability was identified in FreeScout, versions v.1.8.173 and 1.8.174. The discovered vulnerability allows an attacker to store an XSS payload that later triggers forged requests on behalf of the victim CSRF, broadening the impact of the attack. Vulnerability status: Confirmed by vendor...

PT-2025-45: Arbitrary file upload in FreeScout

The vulnerability was identified in FreeScout, versions v.1.8.173 and 1.8.174. The discovered vulnerability allows an attacker to upload arbitrary including executable files containing malicious code because the application does not perform sufficient validation of uploaded files. Vulnerability...

PT-2025-55: Business Logic Errors in FreeScout

The vulnerability was identified in FreeScout, versions v.1.8.173 and 1.8.174. The discovered vulnerability allows an attacker to skip a required workflow step and still obtain the functional capability. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 23.05.2025...

PT-2025-43: Deserialization of untrusted data in FreeScout

The vulnerability was identified in FreeScout, versions v.1.8.173 and 1.8.174. The discovered vulnerability allows an attacker to execute arbitrary code on the server because the application performs insufficient validation of user‑supplied data during deserialization. Vulnerability status:...

PT-2025-42: Insufficient Protection Against CRLF-injection in FreeScout

The vulnerability was identified in FreeScout, versions v.1.8.173 and 1.8.174. The discovered vulnerability allows an attacker to inject special characters into string‑formatting functions because user input is not properly validated, leading to CRLF‑injection attacks. Vulnerability status:...

PT-2025-23249 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The issue is related to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data during mail signature sanitization. An attacker can inject arbitra...

PT-2025-23148 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.178 Description: The issue is related to insufficient validation of user-supplied data, which is used as arguments to string formatting functions. This allows an attacker to pass a string containing special...

PT-2025-23243 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The application's logic allows access to a functional capability without correctly completing one or more actions in the required sequence. This issue leaves the attributes of the Mailbox objec...

PT-2025-23250 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.178 Description: The issue is related to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data in the conversation POST data body. Recommendations: For versions...

PT-2025-23177 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.179 Description: The issue allows users to view arbitrary messages from other mailboxes or conversations they do not have access to, due to a lack of checks when creating a conversation from a message in anothe...

PT-2025-58: Stored Cross-site scripting in FreeScout

The vulnerability was identified in FreeScout, versions v.1.8.173 and 1.8.174. The discovered vulnerability allows an attacker to store malicious HTML/JavaScript scripts that is later executed in other users’ browsers due to insufficient input validation and sanitization. Vulnerability status:...

PT-2025-23173

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.179 Description The issue concerns insufficient checking of files uploaded to the application, allowing files with phtml and phar extensions to be uploaded. This can lead to remote code execution if the Apache w...

PT-2025-23264 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.181 Description: The issue arises from incorrect validation of last name and first name during profile data updates, allowing the injection of arbitrary JavaScript code. This code is executed in a message when...

PT-2025-23178 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The application incorrectly checks user access rights for conversations. Users with show only assigned conversations enabled can assign themselves to an arbitrary conversation from the mailbox ...

PT-2025-23263 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The issue allows an attacker to upload an HTML file containing malicious JavaScript code to the server, resulting in a Cross-Site Scripting XSS vulnerability. This occurs when the .htaccess fil...

PT-2025-23172 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.178 Description: The issue is related to insufficient validation of user input in the php path parameter, allowing code injection. This occurs because backticks characters and tabulation are not removed from us...

PT-2025-23245 · Unknown +1 · Laravel Translation Manager +1

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The issue concerns the laravel-translation-manager package in FreeScout, which does not correctly validate user input. This enables the deletion of any directory, given sufficient access rights...

PT-2025-23246 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The issue allows an authorized user with the administrator role or the privilege User::PERM EDIT USERS to create a user and specify the path to the user's avatar as ../.htaccess during creation...

PT-2025-23179 · Freescout · Freescout

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.180 Description: The system does not provide a check on which clients an authorized user can view and edit. As a result, an authorized user without access to existing mailboxes or conversations can view and edi...