345 matches found
CVE-2026-105098
A security flaw exists in Omega Solution CoinEx Crypto 2025 within the Support Ticket API component. Specifically, an unknown function in the /ticket/customer file is vulnerable to information disclosure when an attacker remotely manipulates the status/page/count arguments. While a public exploit...
EUVD-2026-92066
A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The manipulation of the argument status/page/count results in information disclosure. The attack can be executed remotely. Th...
CVE-2023-52268
FreeScout 최종 사용자 포털 인증 우회 익스플로잇 CVE-2023-52268 개요 이 익스플로잇은 FreeScout 최종 사용자 포털 모듈버전 1.0.65 미만의 취약점을 대상으로 하며, 부적절한 세션 토큰 관리를 통해 공격자가 인증을 우회할 수 있게 합니다. 세션 토큰을 생성하고 테스트함으로써 공격자는 티켓 시스템에 무단으로 접근하여 사용자를 가장하고 해당 사용자의 지원 티켓에 접근할 수 있습니다. 결정적으로, 생성된 세션 토큰은 매직 링크 인증을 요청한 사용자가 아닌 다른 사용자에게 매핑되므로, 공격자가 임의의 사용...
CVE-2026-11399
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-11399 Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-11399
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in all versions up to and including 2.1.6 . The root cause is a lack of validation on a user-controlled 'id' parameter during deletion requests. This allows authenti...
EUVD-2026-91917
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion vulnerability
Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary Ticket Response Deletion vulnerability discovered by Saruul in WordPress Plugin Helpdesk Support Ticket System for WooCommerce versions = 2.1.6...
CVE-2026-63105 ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting XSS vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue,...
CVE-2026-18818: Authorization Bypass Through User-Controlled Key
A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The...
CVE-2026-14929: Incorrect Authorization
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...
CVE-2026-66031
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...
EUVD-2026-49397
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...
CVE-2026-15665: Improper Neutralization of Input During Web Page Generation
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...
CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...
CVE-2026-15011: Improper Control of Generation of Code
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...
CVE-2026-44585: Authorization Bypass Through User-Controlled Key
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...