CVE-2026-27637

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's TokenAuth middleware uses a predictable authentication token computed as MD5userid + createdat + APPKEY. This token is static never expires/rotates, and if an attacker obtains...

EUVD-2026-8611

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's TokenAuth middleware uses a predictable authentication token computed as MD5userid + createdat + APPKEY. This token is static never expires/rotates, and if an attacker obtains...

CVE-2026-27637

FreeScout (Laravel-based) before version 1.8.206 is affected by two linked issues. CVE-2026-27637: the TokenAuth middleware uses a predictable token computed as MD5(user_id + created_at + APP_KEY). The token is static and, if an attacker obtains APP_KEY, they can generate a valid token for any us...

CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's TokenAuth middleware uses a predictable authentication token computed as MD5userid + createdat + APPKEY. This token is static never expires/rotates, and if an attacker obtains...

PT-2026-21854

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.206 Description FreeScout’s TokenAuth middleware generates authentication tokens using a predictable method: MD5user id + created at + APP KEY. These tokens are static and do not expire or rotate. If an attacker...

EUVD-2017-0233

Malware in sbrugna...

CVE-2025-34216

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 VA deployments only expose a set of unauthenticated REST API endpoints that return configuration files and clear‑text passwords. The same endpoints also disclose the...

VulnCheck KEV: CVE-2018-15133

Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key APPKEY environment variable...