Overview 50 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 20 public PoC · 1 EPSS ≥ 0.5
50matches
0in Waratek scope0.0%
0protected0.0%
1exploited2.0%
0CISA KEV0.0%
20public PoC40.0%
1EPSS ≥ 0.52.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
50
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
50
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 8 / year
20021
Not applicable1
High1
not blocked1
Working exploit published1
20031
Not applicable1
High1
not blocked1
Working exploit published1
20042
Not applicable2
High2
not blocked2
Working exploit published2
20054
Not applicable4
High4
not blocked4
Working exploit published3
No public exploit1
20065
Not applicable5
High5
not blocked5
Working exploit published3
No public exploit2
20075
Not applicable5
High5
not blocked5
Working exploit published1
No public exploit4
20080
20092
Not applicable2
High2
not blocked2
Working exploit published2
20101
Not applicable1
High1
not blocked1
Working exploit published1
20110
20120
20130
20140
20150
20160
20178
Not applicable8
High8
not blocked8
Exploited1
Working exploit published5
No public exploit2
20180
20192
Not applicable2
High2
not blocked2
No public exploit2
20202
Not applicable2
High2
not blocked2
No public exploit2
20211
Not applicable1
High1
not blocked1
No public exploit1
20221
Not applicable1
High1
not blocked1
No public exploit1
20235
Not applicable5
High5
not blocked5
Proof of concept only1
No public exploit4
20242
Not applicable2
High2
not blocked2
Proof of concept only1
No public exploit1
20258
Not applicable8
High8
not blocked8
Proof of concept only1
No public exploit7
200320052007200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-10655 | High | 2025-12-09 | Not applicable | Proof of concept only | SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0. |
| CVE-2024-50394 | High | 2025-03-07 | Not applicable | No public exploit | An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: Helpdesk 3.3.3 and later |
| CVE-2023-42232 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Navigator/Index function. |
| CVE-2023-42231 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users by sending a request to the "WSCView/Delete" function. |
| CVE-2023-42228 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a request to the "AclList/SaveAclRules" administrative function. |
| CVE-2023-42227 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the WSCView/Save function. |
| CVE-2023-42226 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function. |
| CVE-2023-42225 | High | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function. |
| CVE-2024-51377 | High | 2024-11-01 | Not applicable | Proof of concept only | An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields |
| CVE-2023-51537 | High | 2024-06-12 | Not applicable | No public exploit | Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.5. |
| CVE-2023-3037 | High | 2023-10-04 | Not applicable | No public exploit | Improper authorization vulnerability in HelpDezk Community affecting version 1.1.10. This vulnerability could allow a remote attacker to access the platform without authentication and retrieve personal data via the jsonGrid parameter. |
| CVE-2023-1724 | High | 2023-06-24 | Not applicable | No public exploit | Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. This occurs because the application is vulnerable to stored XSS. |
| CVE-2023-23679 | High | 2023-06-23 | Not applicable | No public exploit | Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7. |
| CVE-2023-34923 | High | 2023-06-22 | Not applicable | Proof of concept only | XML Signature Wrapping (XSW) in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Provider (IP) to impersonate any TOPdesk user via SAML Response manipulation. |
| CVE-2023-25350 | High | 2023-03-24 | Not applicable | No public exploit | Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection. |
| CVE-2021-35254 | High | 2022-03-25 | Not applicable | No public exploit | SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future. |
| CVE-2021-28814 | High | 2021-06-11 | Not applicable | No public exploit | An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4. |
| CVE-2020-26546 | High | 2020-10-12 | Not applicable | No public exploit | An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2019-20002 | High | 2020-04-27 | Not applicable | No public exploit | Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=group TSV export by an admin user. |
| CVE-2018-0728 | High | 2019-12-04 | Not applicable | No public exploit | This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions. |
| CVE-2017-18486 | High | 2019-08-09 | Not applicable | No public exploit | Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user. |
| CVE-2017-13068 | High | 2017-10-06 | Not applicable | Working exploit published | QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain Helpdesk application information. A remote attacker does not require any privileges to successfully execute this attack. |
| CVE-2017-14320 | High | 2017-09-21 | Not applicable | No public exploit | Mirasvit Helpdesk MX before 1.5.3 might allow remote attackers to execute arbitrary code by leveraging failure to filter uploaded files. |
| CVE-2015-4075 | High | 2017-09-20 | Not applicable | Working exploit published | The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task. |
| CVE-2015-4074 | High | 2017-09-20 | Not applicable | Exploited | Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task. |
| CVE-2017-14146 | High | 2017-09-05 | Not applicable | No public exploit | HelpDEZk 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory. |
| CVE-2017-7571 | High | 2017-04-06 | Not applicable | Working exploit published | public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges. |
| CVE-2017-7447 | High | 2017-04-05 | Not applicable | Working exploit published | HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code. |
| CVE-2017-7446 | High | 2017-04-05 | Not applicable | Working exploit published | HelpDEZk 1.1.1 has CSRF in admin/home#/person/ with an impact of obtaining admin privileges. |
| CVE-2010-2907 | High | 2010-07-28 | Not applicable | Working exploit published | SQL injection vulnerability in the Huru Helpdesk (com_huruhelpdesk) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a detail action to index.php. |
| CVE-2008-6917 | High | 2009-08-07 | Not applicable | Working exploit published | SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQL commands via the username (user parameter). |
| CVE-2008-6380 | High | 2009-03-02 | Not applicable | Working exploit published | SQL injection vulnerability in default.aspx in Active Web Helpdesk 2.0 allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter. |
| CVE-2007-6550 | High | 2007-12-28 | Not applicable | Working exploit published | form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter. |
| CVE-2007-6186 | High | 2007-11-30 | Not applicable | No public exploit | Unspecified vulnerability in PHPDevShell before 0.7.0 has unknown impact and attack vectors, involving a "minor security bug in repair & optimize database." |
| CVE-2007-6174 | High | 2007-11-30 | Not applicable | No public exploit | PHPDevShell before 0.7.0 allows remote authenticated users to gain privileges via a crafted request to update a user profile. NOTE: some of these details are obtained from third party information. |
| CVE-2007-5991 | High | 2007-11-15 | Not applicable | No public exploit | SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a profile fn action. |
| CVE-2007-5916 | High | 2007-11-10 | Not applicable | No public exploit | SQL injection vulnerability in the login page in phphelpdesk 0.6.16 allows remote attackers to execute arbitrary SQL commands via unspecified parameters related to the "login procedures." |
| CVE-2006-6381 | High | 2006-12-07 | Not applicable | Working exploit published | Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. |
| CVE-2006-5951 | High | 2006-11-17 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter. |
| CVE-2006-5474 | High | 2006-10-24 | Not applicable | No public exploit | The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset. |
| CVE-2006-4539 | High | 2006-09-05 | Not applicable | No public exploit | (1) includes/widgets/module_company_tickets.php and (2) includes/widgets/module_track_tickets.php Client Support Center in Cerberus Helpdesk 3.2 Build 317, and possibly earlier, allows remote attackers to bypass security restrictions and obtain sensitive information via the ticket parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information. |
| CVE-2006-3930 | High | 2006-07-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in admin.a6mambohelpdesk.php in a6mambohelpdesk Mambo Component 18RC1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter. |
| CVE-2005-4628 | High | 2005-12-31 | Not applicable | No public exploit | SQL injection vulnerability in index.php in HelpDeskPoint 2.38 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. |
| CVE-2005-4427 | High | 2005-12-20 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file_id parameter to attachment_send.php, (2) the $addy variable in email_parser.php, (3) $address variable in email_parser.php, (4) $a_address variable in structs.php, (5) kbid parameter to cer_KnowledgebaseHandler.class.php, (6) queues[] parameter to addresses_export.php, (7) $thread variable to display.php, (8) ticket parameter to display_ticket_thread.php. |
| CVE-2005-3925 | High | 2005-11-30 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Central Manchester CLC Helpdesk Issue Manager 0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) detail[], (2) orderdir, and (3) orderby parameters to find.php, and the (4) id parameter to issue.php. |
| CVE-2005-3826 | High | 2005-11-26 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Ezyhelpdesk 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) edit_id, (2) faq_id, and (3) c_id parameters in a query string, and (4) the search engine, possibly involving the search_string parameter. |
| CVE-2004-2737 | High | 2004-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter. |
| CVE-2004-2562 | High | 2004-12-31 | Not applicable | Working exploit published | SQL injection vulnerability in jobedit.asp in Leigh Business Enterprises (LBE) Web Helpdesk before 4.0.0.81 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2003-0304 | High | 2003-06-09 | Not applicable | Working exploit published | one||zero (aka One or Zero) Helpdesk 1.4 rc4 allows remote attackers to create administrator accounts by directly calling the install.php Helpdesk Installation script. |
| CVE-2002-0931 | High | 2002-10-04 | Not applicable | Working exploit published | Cross-site scripting vulnerabilities in MyHelpDesk 20020509, and possibly other versions, allows remote attackers to execute script as other users via a (1) Title or (2) Description when a new ticket is created by a support assistant, via the "id" parameter to the index.php script with the (3) tickettime, (4) ticketfiles, or (5) updateticketlog operations, or (6) via the update section when a ticket is edited. |