CVE-2026-114396 Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or...

CVE-2026-114396

Trudesk through version 1.2.11 is vulnerable to a server-side JavaScript injection via the tickets search API. Authenticated users can inject code into a MongoDB $where clause through the search parameter in a GET request to /api/v1/tickets/search. By closing the regular expression, an attacker c...

CVE-2018-20779

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

CVE-2018-20779

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

Sql injection

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

CVE-2018-20779

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

PT-2019-10222

Name of the Vulnerable Software and Affected Versions: Traq version 3.7.1 Description: The issue allows for SQL injection via a tickets?search= URI. Recommendations: For version 3.7.1, update to a newer version that contains a fix for this issue...

CVE-2018-20779: Improper Neutralization of Special Elements used in an SQL Command

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

transsiberianexpress.net XSS vulnerability

Open Bug Bounty ID: OBB-599988 Description| Value ---|--- Affected Website:| transsiberianexpress.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...