CVE-2024-57727

CVE-2024-57727 CVE-2024-57727 python poc.py http://target python poc.py https://192.168.32.130 + https://192.168.32.130 is vulnerable blog: https://rustlang.rs/posts/simple-help/...

Helpdesk-Telecom-CVE-2025-64459

Preparing to download the repository 1. Update packages: sudo apt update 2. If necessary, install git: sudo apt install -y git 3. It is necessary to set up port forwarding rules. In the "Network" settings of the Debian 12.11.0 machine, click "Port Forwarding". 4. Add a rule: Name: Django; Protoco...

nextcloud-ldap-put-isadmin

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-ldap-put-isadmin nextcloud-ldap-put-isadmin Nextcloud Server 35.0.0 - Nextcloud GmbH PUT /cloud/users/id lets a delegated Users admin edit a target unless that target is in the local group admin. PATCH on th...

CVE-2026-111939

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...

CVE-2026-111939

Frappe Helpdesk versions prior to 1.26.0 are vulnerable to an authorization bypass (CWE-639). The flaw allows authenticated portal users to create tickets while impersonating other customers by providing a specific raised_by value when calling the hd_ticket.api.new endpoint. This allows an attack...

CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...

EUVD-2026-104312

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...

CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in...

JitBit_Helpdesk_Auth_Bypass

This repository does not have a README...

CVE-2026-111676

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-111676 Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

EUVD-2026-102967

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-111676 Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-111676

Faveo Helpdesk versions through 2.0.3 are vulnerable to a broken access control flaw in the getTooltip handler. Authenticated agents can exploit this by enumerating sequential ticketid values via a GET request to the /ticket/tooltip endpoint. This allows unauthorized access to ticket conversation...

CVE-2026-111311

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

EUVD-2026-102820

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

CVE-2026-111311

The DoubleScale | All-in-One CRM plugin for WordPress (versions up to and including 1.5.1 ) is vulnerable to Arbitrary File Upload via the store_upload function. The root cause is a fail-open extension allow-list in extension_is_allowed() which returns true when wp_check_filetype() yields an empt...

CVE-2026-111311 DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

CVE-2026-103768

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possibl...

CVE-2026-103768 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possibl...