Cross site request forgery (csrf)

The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsctickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter stored...

CVE-2021-42137

Summary of CVE-2021-42137 (Zammad): Zammad before 5.0.1 contains an authorization flaw that improperly enforces privilege requirements when viewing a list of tickets (shows title, state, etc.). This affects versions prior to 5.0.1 and arises from insufficient access control. Reported across multi...