Trudesk Project
Products
1- 31 CVEs
Recent CVEs
31| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-2128 | Cri | 0.64 | 9.8 | 0.03 | Jun 20, 2022 | Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. | ||
| CVE-2022-2023 | Cri | 0.64 | 9.8 | 0.03 | Jun 20, 2022 | Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. | ||
| CVE-2022-1775 | Cri | 0.64 | 9.8 | 0.02 | May 20, 2022 | Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2. | ||
| CVE-2022-1808 | Hig | 0.58 | 8.8 | 0.04 | May 31, 2022 | Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3. | ||
| CVE-2022-1770 | Hig | 0.57 | 8.8 | 0.03 | May 20, 2022 | Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2. | ||
| CVE-2022-1931 | Hig | 0.53 | 8.1 | 0.02 | May 31, 2022 | Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3. | ||
| CVE-2022-1752 | Hig | 0.52 | 8.0 | 0.02 | May 21, 2022 | Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2. | ||
| CVE-2022-1718 | Hig | 0.49 | 7.5 | 0.01 | Sep 29, 2022 | The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of… | ||
| CVE-2026-114397 | Hig | 0.48 | 7.4 | 0.01 | Oct 21, 2026 | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded… | ||
| CVE-2026-114396 | Hig | 0.46 | 7.1 | 0.01 | Oct 21, 2026 | Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for… | ||
| CVE-2022-1803 | Med | 0.45 | 6.9 | 0.02 | May 20, 2022 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2. | ||
| CVE-2026-114399 | Med | 0.42 | 6.5 | 0.01 | Oct 21, 2026 | Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to… | ||
| CVE-2021-45785 | Med | 0.42 | 6.5 | 0.00 | Jun 24, 2024 | TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart… | ||
| CVE-2022-1947 | Med | 0.42 | 6.5 | 0.01 | May 31, 2022 | Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. | ||
| CVE-2022-1754 | Med | 0.42 | 6.5 | 0.01 | May 20, 2022 | Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2. | ||
| CVE-2022-1728 | Med | 0.42 | 6.5 | 0.01 | May 16, 2022 | Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications. | ||
| CVE-2022-1044 | Med | 0.42 | 6.5 | 0.01 | May 12, 2022 | Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1. | ||
| CVE-2026-114400 | Med | 0.38 | 5.9 | 0.01 | Oct 21, 2026 | Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know… | ||
| CVE-2026-114398 | Med | 0.35 | 5.4 | 0.00 | Oct 21, 2026 | Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload… | ||
| CVE-2023-26982 | Med | 0.35 | 5.4 | 0.01 | Mar 29, 2023 | Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function. |
- risk 0.64cvss 9.8epss 0.03
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4.
- risk 0.64cvss 9.8epss 0.03
Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.
- risk 0.64cvss 9.8epss 0.02
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.
- risk 0.58cvss 8.8epss 0.04
Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.
- risk 0.57cvss 8.8epss 0.03
Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.
- risk 0.53cvss 8.1epss 0.02
Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.
- risk 0.52cvss 8.0epss 0.02
Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2.
- risk 0.49cvss 7.5epss 0.01
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of…
- risk 0.48cvss 7.4epss 0.01
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded…
- risk 0.46cvss 7.1epss 0.01
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for…
- risk 0.45cvss 6.9epss 0.02
Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.
- risk 0.42cvss 6.5epss 0.01
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to…
- risk 0.42cvss 6.5epss 0.00
TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to restart the server, causing a DoS attack. The attacker must craft a webpage that would perform a GET request to the /api/v1/admin/restart…
- risk 0.42cvss 6.5epss 0.01
Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.
- risk 0.42cvss 6.5epss 0.01
Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2.
- risk 0.42cvss 6.5epss 0.01
Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
- risk 0.42cvss 6.5epss 0.01
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in GitHub repository polonel/trudesk prior to v1.2.1.
- risk 0.38cvss 5.9epss 0.01
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know…
- risk 0.35cvss 5.4epss 0.00
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload…
- risk 0.35cvss 5.4epss 0.01
Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function.