CVE-2023-39147

CVE-2023-39147 affects Uvdesk 1.1.3, describing an arbitrary file upload vulnerability that allows attackers to execute arbitrary code via uploading a crafted image file. Public references describe a remote code execution path through an uploaded shell (e.g., authenticated exploit in Uvdesk 1.1.3...

CVE-2023-37636

CVE-2023-37636 concerns UVDesk Community Skeleton v1.1.1, with a stored XSS vulnerability in the Message field used when creating a ticket. The issue allows attackers to inject arbitrary web scripts/HTML, potentially affecting users who view crafted tickets. The primary technical detail across so...