Lucene search
+L

4797 matches found

Patchstack
Patchstack
•added 2026/07/24 6:11 a.m.•19 views

WordPress Customer Support Ticket System & Helpdesk plugin <= 6.0.5 - Unauthenticated Code Injection vulnerability

Unauthenticated Code Injection vulnerability discovered by theviper17y in WordPress Plugin WP Ticket Customer Service Software & Support Ticket System versions = 6.0.5...

9.8CVSS5.3AI score0.00954EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
•added 2026/07/24 12:00 a.m.•23 views

PT-2026-64277

Name of the Vulnerable Software and Affected Versions Apereo CAS Client version 4.1.0 Jasig CAS Client version 3.6.4 Description The software accepts any CA-trusted certificate for any hostname as long as the URL being called matches the configured allowlist or regex. A Man-in-the-Middle MITM...

7.4CVSS5.7AI score0.0026EPSS
SaveExploits0References9
Vulnrichment
Vulnrichment
•added 2026/07/23 8:34 a.m.•17 views

CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

9.8CVSS5.5AI score0.00954EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/07/23 8:34 a.m.•42 views

CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

9.8CVSS0.00954EPSS
SaveExploits0References6
OSV
OSV
•added 2026/07/23 2:39 a.m.•7 views

ECHO-6303-1FDB-ED48

Bulletin has no description...

6.5CVSS4.7AI score0.00381EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/07/20 8:04 p.m.•14 views

EUVD-2026-46090

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

5.4CVSS5.3AI score0.00285EPSS
SaveExploits0References1
attackerkb
attackerkb
•added 2026/07/20 8:04 p.m.•14 views

CVE-2026-44585

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

5.4CVSS5.3AI score0.00285EPSS
SaveExploits0References2Affected Software1
OSV
OSV
•added 2026/07/20 8:04 p.m.•13 views

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

5.4CVSS5.4AI score
SaveExploits0References3
CVE
CVE
•added 2026/07/20 8:04 p.m.•64 views

CVE-2026-44585

CVE-2026-44585 affects Paymenter prior to v1.5.0. The ticket creation endpoint validates ownership of a user-supplied service identifier is not enforced, enabling an authenticated user to create tickets that reference another user’s service. Impact stated: no direct access to service contents or ...

5.4CVSS5.3AI score0.00285EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/07/20 8:04 p.m.•48 views

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

5.4CVSS0.00285EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/07/20 8:04 p.m.•11 views

CVE-2026-44585 Paymenter: Broken object level authorization via service reference manipulation on ticket creation

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing...

5.4CVSS5.3AI score0.00285EPSS
SaveExploits0References1
attackerkb
attackerkb
•added 2026/07/20 7:18 p.m.•10 views

CVE-2026-44229

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...

5.4CVSS5.2AI score0.0024EPSS
SaveExploits0References3Affected Software1
UbuntuCve
UbuntuCve
•added 2026/07/20 6:16 p.m.•33 views

CVE-2026-44228

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

5.4CVSS5.4AI score0.00255EPSS
SaveExploits0References1
OSV
OSV
•added 2026/07/20 6:16 p.m.•16 views

UBUNTU-CVE-2026-44228

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

5.4CVSS5.8AI score0.00255EPSS
SaveExploits0References2
GithubExploit
GithubExploit
•added 2026/07/20 3:52 p.m.•78 views

Exploit for CVE-2026-11374

CVE-2026-11374 ManageEngine AD360 Precondition Detection Scrip...

9CVSS5.7AI score0.02523EPSS
SaveExploits1
CVE
CVE
•added 2026/07/17 2:55 p.m.•52 views

CVE-2026-14871

This CVE affects osTicket versions 1.18.3 and 1.17.7, where a Broken Object Level Authorization (BOLA) leads to an Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem. The issue enables cross-department data disclosure due to improper access controls on object referenc...

7.1CVSS5.3AI score0.00427EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/07/17 2:55 p.m.•56 views

CVE-2026-14871 osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...

7.1CVSS0.00427EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/07/17 2:55 p.m.•24 views

EUVD-2026-45186

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...

7.1CVSS5.3AI score0.00427EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/07/17 2:55 p.m.•17 views

CVE-2026-14871 osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...

7.1CVSS5.3AI score0.00427EPSS
SaveExploits0References5
attackerkb
attackerkb
•added 2026/07/17 2:55 p.m.•12 views

CVE-2026-14871

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...

7.1CVSS5.3AI score0.00427EPSS
SaveExploits0References6Affected Software1
Rows per page
Query Builder