Overview 124 matches · 2 in Waratek scope · 1 protected · 5 exploited · 1 CISA KEV · 40 public PoC · 1 EPSS ≥ 0.5
124matches
2in Waratek scope1.6%
1protected0.8%
5exploited4.0%
1CISA KEV0.8%
40public PoC32.3%
1EPSS ≥ 0.50.8%
Protected by Waratek
1
0.8%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
0.8%
Outside Waratek scope
0
0.0%
Not applicable
122
98.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.8%
partly blocked
0
0.0%
not blocked
123
99.2%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 14 / year
20022
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20032
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20043
Not applicable3
High2
Medium1
not blocked3
Working exploit published3
20059
Not applicable9
High4
Medium5
not blocked9
Working exploit published4
No public exploit5
200611
Not applicable11
High5
Medium6
not blocked11
Working exploit published8
No public exploit3
200711
Not applicable11
High5
Medium6
not blocked11
Working exploit published4
No public exploit7
20081
Not applicable1
Medium1
not blocked1
Working exploit published1
20095
Not applicable5
High2
Medium3
not blocked5
Working exploit published3
No public exploit2
20104
Not applicable4
High1
Medium3
not blocked4
Working exploit published4
20112
Not applicable2
Medium2
not blocked2
No public exploit2
20120
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20140
20150
20160
201714
Not applicable14
Critical2
High8
Medium4
not blocked14
Exploited2
Working exploit published8
No public exploit4
20183
Not applicable3
Critical1
Medium2
not blocked3
No public exploit3
20192
Not applicable2
High2
not blocked2
No public exploit2
202011
Not applicable11
Critical3
High2
Medium6
not blocked11
No public exploit11
20217
Not applicable7
Critical3
High1
Medium3
not blocked7
Exploited3
No public exploit4
20225
No exploit published1
Not applicable4
High1
Medium4
not blocked5
No public exploit5
20238
Protected by Waratek1
Not applicable7
Critical1
High5
Medium2
blocked by ARMR today1
not blocked7
Proof of concept only2
No public exploit6
20244
Not applicable4
High2
Medium2
not blocked4
Proof of concept only1
No public exploit3
202514
Not applicable14
High8
Medium6
not blocked14
Proof of concept only3
No public exploit11
20265
Not applicable5
Medium5
not blocked5
No public exploit5
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-23758 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Controller_Ticket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket. |
| CVE-2026-23757 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface. |
| CVE-2026-23756 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject field, and the payload executes when any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link. |
| CVE-2026-23753 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subsequently rendered unsanitized by View_Language.RenderGrid(). An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, and the payload executes in the browser of any administrator viewing the Languages page. |
| CVE-2026-23752 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inject malicious scripts through the companyname field that execute in the browsers of any administrator viewing the Templates > Groups page. |
| CVE-2025-10655 | High | 2025-12-09 | Not applicable | Proof of concept only | SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0. |
| CVE-2018-25111 | Medium | 2025-05-31 | Not applicable | Proof of concept only | django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py. |
| CVE-2024-50394 | High | 2025-03-07 | Not applicable | No public exploit | An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: Helpdesk 3.3.3 and later |
| CVE-2024-46226 | Medium | 2025-02-26 | Not applicable | Proof of concept only | A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket. |
| CVE-2023-42234 | Medium | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Request Forgery (CSRF) via the WSCView function. |
| CVE-2023-42233 | Medium | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the Filter/FilterEditor function. |
| CVE-2023-42232 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index function. |
| CVE-2023-42231 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users by sending a request to the "WSCView/Delete" function. |
| CVE-2023-42230 | Medium | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the WSCView/Save function. |
| CVE-2023-42229 | Medium | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal. Arbitrary files can be created on the system via authenticated SOAP requests to the WSConnector service. |
| CVE-2023-42228 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a request to the "AclList/SaveAclRules" administrative function. |
| CVE-2023-42227 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function. |
| CVE-2023-42226 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function. |
| CVE-2023-42225 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function. |
| CVE-2024-51377 | High | 2024-11-01 | Not applicable | Proof of concept only | An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields |
| CVE-2024-27125 | Medium | 2024-09-06 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following version: Helpdesk 3.3.1 and later |
| CVE-2023-51537 | High | 2024-06-12 | Not applicable | No public exploit | Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.5. |
| CVE-2024-2078 | Medium | 2024-03-01 | Not applicable | No public exploit | A Cross-Site Scripting (XSS) vulnerability has been found in HelpDeskZ affecting version 2.0.2 and earlier. This vulnerability could allow an attacker to send a specially crafted JavaScript payload within the email field and partially take control of an authenticated user's browser session. |
| CVE-2023-4218 | Medium | 2023-11-09 | Protected by Waratek | Proof of concept only | In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch). |
| CVE-2023-3038 | Critical | 2023-10-04 | Not applicable | No public exploit | SQL injection vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the rows parameter of the jsonGrid route and extract all the information stored in the application. |
| CVE-2023-3037 | High | 2023-10-04 | Not applicable | No public exploit | Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform without authentication and retrieve personal data via the jsonGrid parameter. |
| CVE-2023-1724 | High | 2023-06-24 | Not applicable | No public exploit | Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS. |
| CVE-2023-23679 | High | 2023-06-23 | Not applicable | No public exploit | Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7. |
| CVE-2023-34923 | High | 2023-06-22 | Not applicable | Proof of concept only | XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Provider (IP) to impersonate any TOPdesk user via SAML Response manipulation. |
| CVE-2023-28015 | Medium | 2023-05-23 | Not applicable | No public exploit | The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on valid users. |
| CVE-2023-25350 | High | 2023-03-24 | Not applicable | No public exploit | Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection. |
| CVE-2022-44636 | Medium | 2022-12-13 | Not applicable | No public exploit | The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models. |
| CVE-2022-45389 | Medium | 2022-11-15 | No exploit published | No public exploit | A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-specified repository. |
| CVE-2022-31400 | Medium | 2022-06-13 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field. |
| CVE-2022-31398 | Medium | 2022-06-13 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field. |
| CVE-2021-35254 | High | 2022-03-25 | Not applicable | No public exploit | SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future. |
| CVE-2021-35232 | Medium | 2021-12-27 | Not applicable | Exploited | Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database. |
| CVE-2021-3994 | Critical | 2021-12-01 | Not applicable | No public exploit | django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2021-3950 | Medium | 2021-11-19 | Not applicable | No public exploit | django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2021-3945 | Medium | 2021-11-13 | Not applicable | No public exploit | django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2021-28814 | High | 2021-06-11 | Not applicable | No public exploit | An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4. |
| CVE-2020-2507 | Critical | 2021-02-03 | Not applicable | Exploited | The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3. |
| CVE-2020-2506 | Critical | 2021-02-03 | Not applicable | Exploited | The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3. |
| CVE-2019-16959 | Medium | 2020-12-21 | Not applicable | No public exploit | SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. |
| CVE-2019-16957 | Medium | 2020-12-18 | Not applicable | No public exploit | SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. |
| CVE-2019-16955 | Medium | 2020-12-18 | Not applicable | No public exploit | SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. |
| CVE-2020-26546 | High | 2020-10-12 | Not applicable | No public exploit | An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2018-19948 | Medium | 2020-09-11 | Not applicable | No public exploit | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow attackers to force NAS users to execute unintentional actions through a web application. QNAP has already fixed the issue in Helpdesk 3.0.3 and later. |
| CVE-2018-19947 | Medium | 2020-09-11 | Not applicable | No public exploit | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later. |
| CVE-2018-19946 | Medium | 2020-09-11 | Not applicable | No public exploit | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in Helpdesk 3.0.3 and later. |
| CVE-2020-2500 | Critical | 2020-07-01 | Not applicable | No public exploit | This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions. |
| CVE-2020-11431 | Critical | 2020-05-07 | Not applicable | No public exploit | The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitrary system files and directories on the target server via Directory Traversal. |
| CVE-2019-20002 | High | 2020-04-27 | Not applicable | No public exploit | Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=group TSV export by an admin user. |
| CVE-2014-8337 | Critical | 2020-01-03 | Not applicable | No public exploit | Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the folder parameter. |
| CVE-2018-0728 | High | 2019-12-04 | Not applicable | No public exploit | This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions. |
| CVE-2017-18486 | High | 2019-08-09 | Not applicable | No public exploit | Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user. |
| CVE-2018-0714 | Critical | 2018-08-13 | Not applicable | No public exploit | Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 and their earlier versions could allow remote attackers to run arbitrary commands in the compromised application. |
| CVE-2018-10232 | Medium | 2018-07-11 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to hijack the authentication of authenticated users for requests that can obtain sensitive information via unspecified vectors. |
| CVE-2018-10231 | Medium | 2018-07-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. |
| CVE-2017-13068 | High | 2017-10-06 | Not applicable | Working exploit published | QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain Helpdesk application information. A remote attacker does not require any privileges to successfully execute this attack. |
| CVE-2017-14321 | Medium | 2017-09-21 | Not applicable | Exploited | Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket. |
| CVE-2017-14320 | High | 2017-09-21 | Not applicable | No public exploit | Mirasvit Helpdesk MX before 1.5.3 might allow remote attackers to execute arbitrary code by leveraging failure to filter uploaded files. |
| CVE-2015-4075 | High | 2017-09-20 | Not applicable | Working exploit published | The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task. |
| CVE-2015-4074 | High | 2017-09-20 | Not applicable | Exploited | Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task. |
| CVE-2015-4073 | Critical | 2017-09-20 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter. |
| CVE-2015-4072 | Medium | 2017-09-20 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message. |
| CVE-2017-14146 | High | 2017-09-05 | Not applicable | No public exploit | HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory. |
| CVE-2017-14145 | Critical | 2017-09-05 | Not applicable | No public exploit | HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATH_INFO, related to the selectWarning function. |
| CVE-2015-4071 | Medium | 2017-08-18 | Not applicable | Working exploit published | The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}. |
| CVE-2017-7276 | Medium | 2017-07-04 | Not applicable | No public exploit | There is reflected XSS in TOPdesk before 5.7.6 and 6.x and 7.x before 7.03.019. |
| CVE-2017-7571 | High | 2017-04-06 | Not applicable | Working exploit published | public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges. |
| CVE-2017-7447 | High | 2017-04-05 | Not applicable | Working exploit published | HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code. |
| CVE-2017-7446 | High | 2017-04-05 | Not applicable | Working exploit published | HelpDEZk 1.1.1 has CSRF in admin/home#/person/ with an impact of obtaining admin privileges. |
| CVE-2013-7191 | Medium | 2013-12-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI for a ticket. |
| CVE-2011-3773 | Medium | 2011-09-24 | Not applicable | No public exploit | PHPDevShell 3.0.0-Beta-4b allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by gzip.php. |
| CVE-2011-3736 | Medium | 2011-09-23 | Not applicable | No public exploit | ExoPHPDesk 1.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by upgrades/upgrade9.php and certain other files. |
| CVE-2010-2907 | High | 2010-07-28 | Not applicable | Working exploit published | SQL injection vulnerability in the Huru Helpdesk (com_huruhelpdesk) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a detail action to index.php. |
| CVE-2009-4548 | Medium | 2010-01-04 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id parameter to (1) products.php, (2) article.php, (3) product_details.php, or (4) reviews.php; the (5) forum_id parameter to forum.php; or the (6) search_category_id parameter to products_search.php. |
| CVE-2009-4544 | Medium | 2010-01-04 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. |
| CVE-2009-4543 | Medium | 2010-01-04 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code via a URL in the lng parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences. |
| CVE-2008-6917 | High | 2009-08-07 | Not applicable | Working exploit published | SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQL commands via the username (user parameter). |
| CVE-2009-0886 | Medium | 2009-03-12 | Not applicable | Working exploit published | Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter. |
| CVE-2009-0861 | Medium | 2009-03-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in phpDenora before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via an IRC channel name. NOTE: some of these details are obtained from third party information. |
| CVE-2008-6440 | Medium | 2009-03-06 | Not applicable | No public exploit | Cerberus Helpdesk before 4.0 (Build 600) allows remote attackers to obtain sensitive information via direct requests for "controllers ... that aren't standard helpdesk pages," possibly involving the (1) /display and (2) /kb URIs. |
| CVE-2008-6380 | High | 2009-03-02 | Not applicable | Working exploit published | SQL injection vulnerability in default.aspx in Active Web Helpdesk 2.0 allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter. |
| CVE-2008-0605 | Medium | 2008-02-06 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in AstroSoft HelpDesk before 1.95.228 allow remote attackers to inject arbitrary web script or HTML via the (1) txtSearch parameter to operator/article/article_search_results.asp and the (2) Attach_Id parameter to operator/article/article_attachment.asp. NOTE: for vector 2, the XSS occurs in a forced SQL error message. |
| CVE-2007-6550 | High | 2007-12-28 | Not applicable | Working exploit published | form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter. |
| CVE-2007-6347 | Medium | 2007-12-13 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in blocks/block_site_map.php in ViArt (1) CMS 3.3.2, (2) HelpDesk 3.3.2, (3) Shop Evaluation 3.3.2, and (4) Shop Free 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the root_folder_path parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2007-6186 | High | 2007-11-30 | Not applicable | No public exploit | Unspecified vulnerability in PHPDevShell before 0.7.0 has unknown impact and attack vectors, involving a "minor security bug in repair & optimize database." |
| CVE-2007-6174 | High | 2007-11-30 | Not applicable | No public exploit | PHPDevShell before 0.7.0 allows remote authenticated users to gain privileges via a crafted request to update a user profile. NOTE: some of these details are obtained from third party information. |
| CVE-2007-5991 | High | 2007-11-15 | Not applicable | No public exploit | SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a profile fn action. |
| CVE-2007-5990 | Medium | 2007-11-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in ExoPHPdesk allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a user profile, possibly the (1) name and (2) website parameters to register.php. |
| CVE-2007-5916 | High | 2007-11-10 | Not applicable | No public exploit | SQL injection vulnerability in the login page in phphelpdesk 0.6.16 allows remote attackers to execute arbitrary SQL commands via unspecified parameters related to the "login procedures." |
| CVE-2007-5915 | Medium | 2007-11-10 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in phphelpdesk 0.6.16 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the whattodo parameter. |
| CVE-2007-5727 | Medium | 2007-10-30 | Not applicable | No public exploit | Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag. |
| CVE-2007-5176 | Medium | 2007-10-03 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in GroupLink eHelpDesk 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) NA_DISPLAYNAME parameter in helpdesk/user/rf_create.jsp and the (2) username and (3) LDAPError parameters in index2.jsp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2007-0676 | Medium | 2007-02-03 | Not applicable | Working exploit published | SQL injection vulnerability in faq.php in ExoPHPDesk 1.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2006-6381 | High | 2006-12-07 | Not applicable | Working exploit published | Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. |
| CVE-2006-6380 | Medium | 2006-12-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. |
| CVE-2006-6366 | Medium | 2006-12-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. |