CVE-2026-92805

CVE-2026-92805 UVdesk unauth wizard super-admin POC UVdesk Community Skeleton through 1.1.8 — installation wizard XHR ConfigureHelpdesk has no authentication and no install-state check. An unauthenticated caller can rewrite DATABASEURL and create a ROLESUPERADMIN. There is no public patched tag...

Exploit for CVE-2026-92805

CVE-2026-92805 UVdesk unauth wizard super-admin POC UVdesk Co...

CVE-2026-92805

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-92805

UVdesk Community Skeleton through version 1.1.8 suffers from missing authentication and installation-state validation on wizard endpoints within ConfigureHelpdesk controller actions. An unauthenticated attacker can submit crafted requests to these wizard endpoints to repoint the database and crea...

CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

EUVD-2026-81065

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

CVE-2026-92805: Missing Authentication for Critical Function

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

PT-2026-94079

Name of the Vulnerable Software and Affected Versions UVdesk Community Skeleton versions prior to 1.1.9 Description The software fails to authenticate or validate the installation state on wizard endpoints within the ConfigureHelpdesk controller actions. This allows unauthenticated attackers to...

EUVD-2023-41517

Malicious code in bioql PyPI...

EUVD-2024-16698

Malicious code in bioql PyPI...

CVE-2023-37635

UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application...

CVE-2024-0916

Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3...

CVE-2024-0916 Unauthenticated Remote Code Execution in UvDesk Community

Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3...

CVE-2024-0916

CVE-2024-0916 affects UVdesk Community (1.0.0–1.1.3) and is due to insufficient input validation that allows unauthenticated file uploads leading to Remote Code Execution (RCE). Public sources describe the vulnerability as an unauthenticated file upload enabling code execution, with references no...

CVE-2024-0916

Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3...

CVE-2024-0916 Unauthenticated Remote Code Execution in UvDesk Community

Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3...

CVE-2024-0916: Unrestricted Upload of File with Dangerous Type

Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3...

PT-2024-15917 · Unknown · Uvdesk Community

Name of the Vulnerable Software and Affected Versions: UvDesk Community versions 1.0.0 through 1.1.3 Description: Unauthenticated file upload allows remote code execution. Recommendations: For UvDesk Community versions 1.0.0 through 1.1.3, consider disabling the file upload feature until a patch ...