CVE-2026-92805

CVE-2026-92805 UVdesk unauth wizard super-admin POC UVdesk Community Skeleton through 1.1.8 — installation wizard XHR ConfigureHelpdesk has no authentication and no install-state check. An unauthenticated caller can rewrite DATABASEURL and create a ROLESUPERADMIN. There is no public patched tag...

Exploit for CVE-2026-92805

CVE-2026-92805 UVdesk unauth wizard super-admin POC UVdesk Co...

CVE-2026-92805

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-92805

UVdesk Community Skeleton through version 1.1.8 suffers from missing authentication and installation-state validation on wizard endpoints within ConfigureHelpdesk controller actions. An unauthenticated attacker can submit crafted requests to these wizard endpoints to repoint the database and crea...

EUVD-2026-81065

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

PT-2026-94079

Name of the Vulnerable Software and Affected Versions UVdesk Community Skeleton versions prior to 1.1.9 Description The software fails to authenticate or validate the installation state on wizard endpoints within the ConfigureHelpdesk controller actions. This allows unauthenticated attackers to...

CVE-2026-92805: Missing Authentication for Critical Function

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

EUVD-2023-41517

Malicious code in bioql PyPI...

CVE-2023-37635

UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application...

CVE-2024-3137 Improper Privilege Management in uvdesk/community-skeleton

Improper Privilege Management in uvdesk/community-skeleton...

CVE-2024-3137

Improper Privilege Management in uvdesk/community-skeleton...

PT-2024-24015 · Unknown · Uvdesk Community Skeleton

Name of the Vulnerable Software and Affected Versions: uvdesk/community-skeleton affected versions not specified Description: The issue concerns improper privilege management. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2024-3137: Improper Privilege Management

Improper Privilege Management in uvdesk/community-skeleton...

CVE-2023-37636

A stored cross-site scripting XSS vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket...

CVE-2023-37636

A stored cross-site scripting XSS vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket...

CVE-2023-37635

UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application...

Cross site scripting

A stored cross-site scripting XSS vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket...