13 matches found
WordPress SupportCandy plugin 3.2.9-3.5.2 - Unauthenticated Ticket Attachment Disclosure vulnerability
Unauthenticated Ticket Attachment Disclosure vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin SupportCandy versions 3.2.9-3.5.2...
WordPress JS Help Desk plugin < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload vulnerability
Unauthenticated Arbitrary Ticket File Attachment Upload vulnerability discovered by Shivamani Vastrala in WordPress Plugin JS Help Desk versions 3.1.4...
CVE-2026-15932: Improper Limitation of a Pathname to a Restricted Directory
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server...
WordPress Support Genix plugin < 1.4.48 - Unauthenticated Ticket Attachment Download vulnerability
Unauthenticated Ticket Attachment Download vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Support Genix versions 1.4.48...
CVE-2026-14930 JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions and attach them to...
CVE-2019-16959
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...
Linux Distros Unpatched Vulnerability : CVE-2015-7684
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an...
CVE-2021-42092
An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...
CVE-2021-42092
The CVE-2021-42092 issue affects Zammad prior to 4.1.1, where a Stored XSS can be triggered when attaching a file to a Ticket via an Article. The root cause is input validation/escaping during attachment handling that allows injected JavaScript to be stored and later executed in the context of th...
Solarwinds WebHelpDesk Injection Vulnerability
Solarwinds WebHelpDesk is a suite of helpdesk and asset management software from Solarwinds USA. The software supports features such as centralized knowledge base, IT asset management, project and task management. An injection vulnerability exists in SolarWinds Web Help Desk version 12.7.0 that...
CVE-2019-16959: Improper Neutralization of Formula Elements in a CSV File
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket...