Trudesk
CVEs (31)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-1719 | Med | 0.35 | 5.4 | 0.01 | Sep 29, 2022 | Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page | ||
| CVE-2022-1045 | Med | 0.35 | 5.4 | 0.02 | Apr 11, 2022 | Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0. | ||
| CVE-2022-1290 | Med | 0.35 | 5.4 | 0.02 | Apr 10, 2022 | Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse. | ||
| CVE-2026-114401 | Med | 0.34 | 5.3 | 0.00 | Oct 21, 2026 | Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish… | ||
| CVE-2026-114392 | Med | 0.34 | 5.3 | 0.00 | Oct 21, 2026 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and… | ||
| CVE-2022-1926 | Med | 0.32 | 4.9 | 0.01 | May 31, 2022 | Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3. | ||
| CVE-2022-1893 | Med | 0.30 | 4.6 | 0.01 | May 31, 2022 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3. | ||
| CVE-2026-114402 | Med | 0.28 | 4.3 | 0.00 | Oct 21, 2026 | Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attackers can supply a username like /../../../x… | ||
| CVE-2026-114395 | Med | 0.28 | 4.3 | 0.00 | Oct 21, 2026 | Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to… | ||
| CVE-2026-114394 | Med | 0.28 | 4.3 | 0.00 | Oct 21, 2026 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests… | ||
| CVE-2026-114393 | Med | 0.28 | 4.3 | 0.00 | Oct 21, 2026 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject,… |
- risk 0.35cvss 5.4epss 0.01
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
- risk 0.35cvss 5.4epss 0.02
Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.
- risk 0.35cvss 5.4epss 0.02
Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
- risk 0.34cvss 5.3epss 0.00
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish…
- risk 0.34cvss 5.3epss 0.00
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and…
- risk 0.32cvss 4.9epss 0.01
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.
- risk 0.30cvss 4.6epss 0.01
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3.
- risk 0.28cvss 4.3epss 0.00
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attackers can supply a username like /../../../x…
- risk 0.28cvss 4.3epss 0.00
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to…
- risk 0.28cvss 4.3epss 0.00
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests…
- risk 0.28cvss 4.3epss 0.00
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject,…
Page 2 of 2