28 matches found
CLEANSTART-2026-SU52028 Vite is a frontend tooling framework for JavaScript
Security vulnerability affects the frappe-helpdesk package. Vite is a frontend tooling framework for JavaScript...
CLEANSTART-2026-OM86662 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree
Security vulnerability affects the frappe-helpdesk package. PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree...
CLEANSTART-2026-CG38853 fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions
Security vulnerability affects the frappe-helpdesk package. fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize and equal functions...
CLEANSTART-2026-UO54678 Security fix for GHSA-67mh-4wv8-2f99 applied in: frappe-helpdesk 1.22.0-r0
Security vulnerability affects the frappe-helpdesk package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-QU63967 DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG
Security vulnerability affects the frappe-helpdesk package. DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG...
CLEANSTART-2026-UG13353 Security fix for GHSA-5c6j-r48x-rmvq applied in: frappe-helpdesk 1.22.0-r0
Security vulnerability affects the frappe-helpdesk package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-111939
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
CVE-2026-111939
Frappe Helpdesk versions prior to 1.26.0 are vulnerable to an authorization bypass (CWE-639). The flaw allows authenticated portal users to create tickets while impersonating other customers by providing a specific raised_by value when calling the hd_ticket.api.new endpoint. This allows an attack...
EUVD-2026-104312
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
CVE-2026-111939: Authorization Bypass Through User-Controlled Key
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...
PT-2026-117401
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised by value. Attackers can call the hd ticket.api.new endpoint with a victim's email to plant phishing tickets in...
Frappe Helpdesk Authorization Issue Vulnerability
Frappe Helpdesk versions prior to 1.26.0 have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Certified portal users can create tickets by providing a raisedby value, pretending to be other customers. Attackers can use the victim’s email to...
Frappe Helpdesk Login Panel - Detect
Frappe Helpdesk products was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Frappe Helpdesk products was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Frappe Helpdesk Login Panel - Detect',...
Frappe Helpdesk get_dashboard_data() Data Compromise
The vulnerability of the getdashboarddata function in the Frappe Helpdesk customer support platform relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the...
CVE-2025-10655
SQL Injection in Frappe HelpDesk in the dashboard getdashboarddata due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0...
EUVD-2025-201950
SQL Injection in Frappe HelpDesk in the dashboard getdashboarddata due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0...