CVE-2026-114396

Trudesk through version 1.2.11 is vulnerable to a server-side JavaScript injection via the tickets search API. Authenticated users can inject code into a MongoDB $where clause through the search parameter in a GET request to /api/v1/tickets/search. By closing the regular expression, an attacker c...