PT-2023-26053 · Unknown · Uvdesk Community Skeleton

Name of the Vulnerable Software and Affected Versions: UVDesk Community Skeleton version 1.1.1 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket. This enables...

Code injection

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers...