CVE-2026-11399

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-11399

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in all versions up to and including 2.1.6 . The root cause is a lack of validation on a user-controlled 'id' parameter during deletion requests. This allows authenti...

CVE-2026-11399 Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

EUVD-2026-91917

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary Ticket Response Deletion vulnerability discovered by Saruul in WordPress Plugin Helpdesk Support Ticket System for WooCommerce versions = 2.1.6...

CVE-2026-36214

CVE-2026-36214 - osTicket 中通过易受攻击的 Bootstrap Tooltip 组件导致的存储型跨站脚本（XSS） 描述 Enhancesoft osTicket 版本从 1.10 到 1.17.7 以及从 1.18.0 到 1.18.3 均包含已知存在漏洞的 Bootstrap Tooltip 3.3.4 组件（CVE-2019-8331），这引入了存储型跨站脚本（XSS）漏洞。 在 osTicket 的默认配置中，工单提交者（“用户”）无需事先认证即可提交工单，且用户自助注册默认开启。远程用户可以构造恶意工单消息，尽管该消息通过了 htmlLawed HTM...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated Stored XSS via File Upload vulnerability

Unauthenticated Stored XSS via File Upload vulnerability discovered by Ayush Srivastava in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...

CVE-2026-19057

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

EUVD-2026-71104

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19081

CVE-2026-19081 is a Missing Authorization vulnerability in Gastromenum Ticket and QR Menu System , a point-of-sale (POS) and QR menu product. The flaw allows an authenticated low-privilege network user to access functionality not properly constrained by ACLs, specifically enabling unauthorized ac...

CVE-2026-19057

Gastromenum Ticket and QR Menu System is affected by a Stored Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The flaw affects versions before 2026.08.31 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with an attack vector of ne...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery vulnerability

Unauthenticated Support Ticket Access via Session Cookie Forgery vulnerability discovered by Kartik sharma in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...

CVE-2026-63105 ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems

ReadyEcommerce before 4.5.2 contains a stored cross-site scripting XSS vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue,...

CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting XSS via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ostthreadentry. When an unauthenticated attacker sends a reply email to an...

WordPress Customer Support Ticket System & Helpdesk plugin <= 6.0.5 - Unauthenticated Code Injection vulnerability

Unauthenticated Code Injection vulnerability discovered by theviper17y in WordPress Plugin WP Ticket Customer Service Software & Support Ticket System versions = 6.0.5...

CVE-2026-15665: Improper Neutralization of Input During Web Page Generation

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-15011: Improper Control of Generation of Code

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-44229

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...