CVE-2023-1724

CVE-2023-1724 affects Faveo Helpdesk Enterprise 6.0.1. The vulnerability is a stored XSS in the application that enables privilege escalation for an attacker possessing agent permissions. Documented impact states that an agent with privileges can escalate within the app; no public exploitation de...

Faveo Helpdesk 跨站脚本漏洞

Faveo Helpdesk is Faveo's open source ticketing system built on the Laravel framework. A security vulnerability exists in Faveo Helpdesk Enterprise version 6.0.1, which stems from the vulnerability of the application to stored XSS, allowing an attacker with proxy privileges to perform privilege...

PT-2023-17193 · Unknown · Faveo Helpdesk Enterprise

Name of the Vulnerable Software and Affected Versions: Faveo Helpdesk Enterprise version 6.0.1 Description: The issue allows an attacker with agent permissions to perform privilege escalation on the application due to a stored XSS vulnerability. Recommendations: For Faveo Helpdesk Enterprise...

CVE-2023-25350

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection...

Sql injection

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection...

CVE-2023-24625

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference IDOR attack...

CVE-2023-24625

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference IDOR attack...

CVE-2023-24625

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference IDOR attack...

Faveo 安全漏洞

Faveo Helpdesk is an open source ticketing system built by Faveo based on Laravel framework. A security vulnerability exists in Faveo version 5.0.1. Attackers use the vulnerability to modify user IDs to obtain sensitive information...

CVE-2023-24625

CVE-2023-24625 affects Faveo Helpdesk, specifically version 5.0.1, where a vulnerability in IDOR (Insecure Direct Object Reference) allows remote attackers to obtain sensitive information by modifying the user ID parameter. The reported impact is exposure of confidential data; base CVSS v3.1 scor...

CVE-2023-25350

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection...

CVE-2023-25350

CVE-2023-25350 affects Faveo Helpdesk versions 1.0–1.11.1. The vulnerability is a SQL injection in the login flow caused by input data from the frontend to the backend being controllable, allowing injection through the login box. The available documents consistently describe the issue and its imp...

CVE-2023-24625

Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference IDOR attack...

CVE-2023-25350

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection...

Faveo Helpdesk SQL注入漏洞

Faveo Helpdesk is an open source ticketing system built by Faveo based on Laravel framework. A security vulnerability exists in Faveo Helpdesk versions 1.0 through 1.11.1, which stems from a controlled parameter passed from the front-end of the login box to the back-end, resulting in an SQL...

CVE-2023-25350

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection...

PT-2023-20035 · Unknown · Faveo Helpdesk

Name of the Vulnerable Software and Affected Versions: Faveo Helpdesk versions 1.0 through 1.11.1 Description: The issue arises from a lack of validation on user input data during the login process. This allows parameters passed from the front end to the back end to be controlled, leading to SQL...

PT-2023-19716 · Faveo · Faveo

Name of the Vulnerable Software and Affected Versions: Faveo version 5.0.1 Description: The issue allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference IDOR attack. Recommendations: For Faveo version 5.0.1, consider restricting acces...

CVE-2021-40925

CVE-2021-40925 is an XSS vulnerability in dompdf/dompdf/www/demo.php used by infaveo-helpdesk v1.11.0 and earlier. The issue arises from reflecting the $_SERVER["PHP_SELF"] parameter, enabling remote attackers to inject arbitrary script/HTML. Affected component: demo.php in the dompdf/dompdf pack...

Faveo Helpdesk 跨站脚本漏洞

Faveo Helpdesk is an open source ticketing system built by Faveo based on Laravel framework. A cross-site scripting vulnerability in Faveo Helpdesk v1.11.0 and below allows remote attackers to inject arbitrary web script or HTML via the $SERVER"PHPSELF" parameter...