109 matches found
CVE-2025-71419
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLEAGENT can inject malicious script into the identifier field, which is persisted and executed wh...
CVE-2025-71420
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLEAGENT can enumerate saved reply identifiers and read content reserved for groups...
CVE-2025-71421
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...
CVE-2025-71421
UVdesk core-framework versions before 1.1.7 contain an improper privilege management vulnerability in the editAgent endpoint. An agent with existing agent-management privilege can submit their own account identifier with the role parameter set to ROLE_ADMIN, escalating their own role to administr...
CVE-2025-71421 UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...
CVE-2025-71420 UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLEAGENT can enumerate saved reply identifiers and read content reserved for groups...
CVE-2025-71420
UVdesk core-framework before 1.1.7 contains an authorization bypass in the saved reply endpoint. Agents holding the ROLE_AGENT permission can enumerate saved reply identifiers and read reply content restricted to other support groups or teams, resulting in a low confidentiality impact (CVSS 3.1 b...
CVE-2025-71419
UVdesk core-framework versions before 1.1.7 are affected by a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. An attacker with the ROLE_AGENT privilege can inject a malicious script into the identifier field;...
CVE-2025-71419: Improper Neutralization of Input During Web Page Generation
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLEAGENT can inject malicious script into the identifier field, which is persisted and executed wh...
CVE-2025-71421: Improper Privilege Management
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to...
CVE-2025-71420: Authorization Bypass Through User-Controlled Key
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLEAGENT can enumerate saved reply identifiers and read content reserved for groups...
CVE-2026-92805
CVE-2026-92805 UVdesk 비인증 wizard 슈퍼 관리자 POC UVdesk Community Skeleton 1.1.8 까지 — 설치 wizard XHRConfigureHelpdesk에는 인증도, 설치 상태 확인도 없습니다. 인증되지 않은 호출자가 DATABASEURL을 재작성하고 ROLESUPERADMIN을 생성할 수 있습니다. 공개된 패치 태그가 없습니다 v1.1.9는 404. 허가된 테스트 전용입니다. 소유하지 않았거나 테스트 권한이 없는 시스템에 대해 실행하지 마십시오. 요구 사항: Python 3, 표...
CVE-2026-92805
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
CVE-2026-92805
UVdesk Community Skeleton through version 1.1.8 suffers from missing authentication and installation-state validation on wizard endpoints within ConfigureHelpdesk controller actions. An unauthenticated attacker can submit crafted requests to these wizard endpoints to repoint the database and crea...
EUVD-2026-81065
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
EUVD-2023-41517
Malicious code in bioql PyPI...