MAL-2025-33162 Malicious code in show-help (npm)

The package show-help was found to contain malicious code...

MAL-2025-7993 Malicious code in @help_center/modules (npm)

The package @helpcenter/modules was found to contain malicious code...

MAL-2025-7995 Malicious code in @help_center/utilities (npm)

The package @helpcenter/utilities was found to contain malicious code...

MAL-2025-28316 Malicious code in open-xchange-appsuite-help (npm)

The package open-xchange-appsuite-help was found to contain malicious code...

MAL-2025-7990 Malicious code in @help_api/types (npm)

The package @helpapi/types was found to contain malicious code...

MAL-2025-16752 Malicious code in ch-react-help (npm)

The package ch-react-help was found to contain malicious code...

Malicious code in @help_api/utilities (npm)

The package @helpapi/utilities was found to contain malicious code...

Malicious code in @help_api/modules (npm)

The package @helpapi/modules was found to contain malicious code...

Malicious code in uni-help (npm)

The package uni-help was found to contain malicious code...

Malicious code in @help_center/config (npm)

The package @helpcenter/config was found to contain malicious code...

Malicious code in @help_api/config (npm)

The package @helpapi/config was found to contain malicious code...

SolarWinds Web Help Desk < 12.8.7 XXE Vulnerability

The version of Solarwinds Web Help Desk installed on the remote host is prior to 12.8.7. It is, therefore, affected by a vulnerability. SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid,...

VulnCheck KEV: CVE-2025-2712

A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploi...

How Scattered Spider Used Fake Calls to Breach Clorox via Cognizant

Specops Software's analysis reveals how Scattered Spider's persistent help desk exploitation cost Clorox $400 million. Understand the August 2023 breach, its operational disruption, and critical steps organisations must take to protect against similar social engineering threats...

CVE-2025-26400 SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...

CVE-2025-26400 SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...

VulnCheck KEV: CVE-2021-35232

Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users ...

SolarWinds Web Help Desk 代码问题漏洞

SolarWinds Web Help Desk is a suite of help desk and asset management software from US-based SolarWinds. The software supports centralized knowledge base, IT asset management, project and task management, and other features. A code issue vulnerability exists in SolarWinds Web Help Desk that...

PT-2025-31182 · Solarwinds · Solarwinds Web Help Desk

Name of the Vulnerable Software and Affected Versions: SolarWinds Web Help Desk affected versions not specified Description: SolarWinds Web Help Desk is susceptible to an XML External Entity XXE injection issue that may result in information disclosure. Successful exploitation requires valid,...

CVE-2025-54366 FreeScout's deserialization of untrusted data leads to Remote Code Execution

FreeScout is a lightweight free open source help desk and shared inbox built with PHP Laravel framework. In versions 1.8.185 and below, there is a critical deserialization vulnerability in the /conversation/ajax endpoint that allows authenticated users with knowledge of the APPKEY to achieve remo...