Overview 64 matches · 2 in Waratek scope · 1 protected · 2 exploited · 0 CISA KEV · 19 public PoC · 0 EPSS ≥ 0.5
64matches
2in Waratek scope3.1%
1protected1.6%
2exploited3.1%
0CISA KEV0.0%
19public PoC29.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
1.6%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
1.6%
Outside Waratek scope
0
0.0%
Not applicable
62
96.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.6%
partly blocked
0
0.0%
not blocked
63
98.4%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 6 / year
20021
Not applicable1
Medium1
not blocked1
Working exploit published1
20031
Not applicable1
Medium1
not blocked1
Working exploit published1
20041
Not applicable1
Medium1
not blocked1
Working exploit published1
20055
Not applicable5
Medium5
not blocked5
Working exploit published1
No public exploit4
20066
Not applicable6
Medium6
not blocked6
Working exploit published5
No public exploit1
20076
Not applicable6
Medium6
not blocked6
Working exploit published3
No public exploit3
20081
Not applicable1
Medium1
not blocked1
Working exploit published1
20093
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20103
Not applicable3
Medium3
not blocked3
Working exploit published3
20112
Not applicable2
Medium2
not blocked2
No public exploit2
20120
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20140
20150
20160
20174
Not applicable4
Medium4
not blocked4
Exploited1
Working exploit published2
No public exploit1
20182
Not applicable2
Medium2
not blocked2
No public exploit2
20190
20206
Not applicable6
Medium6
not blocked6
No public exploit6
20213
Not applicable3
Medium3
not blocked3
Exploited1
No public exploit2
20224
No exploit published1
Not applicable3
Medium4
not blocked4
No public exploit4
20232
Protected by Waratek1
Not applicable1
Medium2
blocked by ARMR today1
not blocked1
Proof of concept only1
No public exploit1
20242
Not applicable2
Medium2
not blocked2
No public exploit2
20256
Not applicable6
Medium6
not blocked6
Proof of concept only2
No public exploit4
20265
Not applicable5
Medium5
not blocked5
No public exploit5
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-23758 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Controller_Ticket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket. |
| CVE-2026-23757 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface. |
| CVE-2026-23756 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject field, and the payload executes when any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link. |
| CVE-2026-23753 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subsequently rendered unsanitized by View_Language.RenderGrid(). An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, and the payload executes in the browser of any administrator viewing the Languages page. |
| CVE-2026-23752 | Medium | 2026-04-20 | Not applicable | No public exploit | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inject malicious scripts through the companyname field that execute in the browsers of any administrator viewing the Templates > Groups page. |
| CVE-2018-25111 | Medium | 2025-05-31 | Not applicable | Proof of concept only | django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py. |
| CVE-2024-46226 | Medium | 2025-02-26 | Not applicable | Proof of concept only | A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket. |
| CVE-2023-42234 | Medium | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Request Forgery (CSRF) via the WSCView function. |
| CVE-2023-42233 | Medium | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the Filter/FilterEditor function. |
| CVE-2023-42230 | Medium | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Cross Site Scripting (XSS) via the WSCView/Save function. |
| CVE-2023-42229 | Medium | 2025-01-13 | Not applicable | No public exploit | Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal. Arbitrary files can be created on the system via authenticated SOAP requests to the WSConnector service. |
| CVE-2024-27125 | Medium | 2024-09-06 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following version: Helpdesk 3.3.1 and later |
| CVE-2024-2078 | Medium | 2024-03-01 | Not applicable | No public exploit | A Cross-Site Scripting (XSS) vulnerability has been found in HelpDeskZ affecting version 2.0.2 and earlier. This vulnerability could allow an attacker to send a specially crafted JavaScript payload within the email field and partially take control of an authenticated user's browser session. |
| CVE-2023-4218 | Medium | 2023-11-09 | Protected by Waratek | Proof of concept only | In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch). |
| CVE-2023-28015 | Medium | 2023-05-23 | Not applicable | No public exploit | The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not. The attacker could use this information to focus a brute force attack on valid users. |
| CVE-2022-44636 | Medium | 2022-12-13 | Not applicable | No public exploit | The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models. |
| CVE-2022-45389 | Medium | 2022-11-15 | No exploit published | No public exploit | A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-specified repository. |
| CVE-2022-31400 | Medium | 2022-06-13 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field. |
| CVE-2022-31398 | Medium | 2022-06-13 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field. |
| CVE-2021-35232 | Medium | 2021-12-27 | Not applicable | Exploited | Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database. |
| CVE-2021-3950 | Medium | 2021-11-19 | Not applicable | No public exploit | django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2021-3945 | Medium | 2021-11-13 | Not applicable | No public exploit | django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2019-16959 | Medium | 2020-12-21 | Not applicable | No public exploit | SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. |
| CVE-2019-16957 | Medium | 2020-12-18 | Not applicable | No public exploit | SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. |
| CVE-2019-16955 | Medium | 2020-12-18 | Not applicable | No public exploit | SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. |
| CVE-2018-19948 | Medium | 2020-09-11 | Not applicable | No public exploit | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow attackers to force NAS users to execute unintentional actions through a web application. QNAP has already fixed the issue in Helpdesk 3.0.3 and later. |
| CVE-2018-19947 | Medium | 2020-09-11 | Not applicable | No public exploit | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later. |
| CVE-2018-19946 | Medium | 2020-09-11 | Not applicable | No public exploit | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in Helpdesk 3.0.3 and later. |
| CVE-2018-10232 | Medium | 2018-07-11 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to hijack the authentication of authenticated users for requests that can obtain sensitive information via unspecified vectors. |
| CVE-2018-10231 | Medium | 2018-07-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. |
| CVE-2017-14321 | Medium | 2017-09-21 | Not applicable | Exploited | Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket. |
| CVE-2015-4072 | Medium | 2017-09-20 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message. |
| CVE-2015-4071 | Medium | 2017-08-18 | Not applicable | Working exploit published | The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}. |
| CVE-2017-7276 | Medium | 2017-07-04 | Not applicable | No public exploit | There is reflected XSS in TOPdesk before 5.7.6 and 6.x and 7.x before 7.03.019. |
| CVE-2013-7191 | Medium | 2013-12-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI for a ticket. |
| CVE-2011-3773 | Medium | 2011-09-24 | Not applicable | No public exploit | PHPDevShell 3.0.0-Beta-4b allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by gzip.php. |
| CVE-2011-3736 | Medium | 2011-09-23 | Not applicable | No public exploit | ExoPHPDesk 1.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by upgrades/upgrade9.php and certain other files. |
| CVE-2009-4548 | Medium | 2010-01-04 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id parameter to (1) products.php, (2) article.php, (3) product_details.php, or (4) reviews.php; the (5) forum_id parameter to forum.php; or the (6) search_category_id parameter to products_search.php. |
| CVE-2009-4544 | Medium | 2010-01-04 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. |
| CVE-2009-4543 | Medium | 2010-01-04 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code via a URL in the lng parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences. |
| CVE-2009-0886 | Medium | 2009-03-12 | Not applicable | Working exploit published | Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter. |
| CVE-2009-0861 | Medium | 2009-03-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in phpDenora before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via an IRC channel name. NOTE: some of these details are obtained from third party information. |
| CVE-2008-6440 | Medium | 2009-03-06 | Not applicable | No public exploit | Cerberus Helpdesk before 4.0 (Build 600) allows remote attackers to obtain sensitive information via direct requests for "controllers ... that aren't standard helpdesk pages," possibly involving the (1) /display and (2) /kb URIs. |
| CVE-2008-0605 | Medium | 2008-02-06 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in AstroSoft HelpDesk before 1.95.228 allow remote attackers to inject arbitrary web script or HTML via the (1) txtSearch parameter to operator/article/article_search_results.asp and the (2) Attach_Id parameter to operator/article/article_attachment.asp. NOTE: for vector 2, the XSS occurs in a forced SQL error message. |
| CVE-2007-6347 | Medium | 2007-12-13 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in blocks/block_site_map.php in ViArt (1) CMS 3.3.2, (2) HelpDesk 3.3.2, (3) Shop Evaluation 3.3.2, and (4) Shop Free 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the root_folder_path parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2007-5990 | Medium | 2007-11-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in ExoPHPdesk allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a user profile, possibly the (1) name and (2) website parameters to register.php. |
| CVE-2007-5915 | Medium | 2007-11-10 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in phphelpdesk 0.6.16 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the whattodo parameter. |
| CVE-2007-5727 | Medium | 2007-10-30 | Not applicable | No public exploit | Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag. |
| CVE-2007-5176 | Medium | 2007-10-03 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in GroupLink eHelpDesk 6.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) NA_DISPLAYNAME parameter in helpdesk/user/rf_create.jsp and the (2) username and (3) LDAPError parameters in index2.jsp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2007-0676 | Medium | 2007-02-03 | Not applicable | Working exploit published | SQL injection vulnerability in faq.php in ExoPHPDesk 1.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2006-6380 | Medium | 2006-12-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. |
| CVE-2006-6366 | Medium | 2006-12-07 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2006-6158 | Medium | 2006-11-28 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in (a) PMOS Help Desk 2.4, formerly (b) InverseFlow Help Desk 2.31 and also sold as (c) Ace Helpdesk 2.31, allow remote attackers to inject arbitrary web script or HTML via the (1) id or email parameter to ticketview.php, or (2) the email parameter to ticket.php. |
| CVE-2006-5428 | Medium | 2006-10-20 | Not applicable | Working exploit published | rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GUI login and obtain sensitive information (ticket data) via a direct request. |
| CVE-2006-2990 | Medium | 2006-06-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in default.asp in VanillaSoft Helpdesk 2005 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter. |
| CVE-2006-0509 | Medium | 2006-02-01 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbitrary web script or HTML via (1) the contact_search parameter and (2) unspecified url fields. |
| CVE-2005-4428 | Medium | 2005-12-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML via the kb_ask parameter. |
| CVE-2005-4285 | Medium | 2005-12-16 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in pdestore.cgi in Dick Copits PDEstore 1.8 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) the search module parameter or the (2) product and (3) cart_id parameters. |
| CVE-2005-3502 | Medium | 2005-11-05 | Not applicable | No public exploit | attachment_send.php in Cerberus Helpdesk allows remote attackers to view attachments and tickets of other users via a modified file_id parameter. |
| CVE-2005-1963 | Medium | 2005-06-16 | Not applicable | No public exploit | Cerberus Helpdesk 0.97.3 allows remote attackers to obtain sensitive information via certain requests to (1) reports.php, (2) knowledgebase.php, or (3) configuration.php, which leaks the information in a PHP error message. |
| CVE-2005-1962 | Medium | 2005-06-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Cerberus Helpdesk 0.97.3 allows remote attackers to inject arbitrary web script or HTML via the (1) errorcode parameter to index.php or (2) certain fields to clients.php. |
| CVE-2004-2736 | Medium | 2004-12-31 | Not applicable | Working exploit published | Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie. |
| CVE-2003-0303 | Medium | 2003-06-09 | Not applicable | Working exploit published | SQL injection vulnerability in one||zero (aka One or Zero) Helpdesk 1.4 rc4 allows remote attackers to modify arbitrary ticket number descriptions via the sg parameter. |
| CVE-2002-0932 | Medium | 2002-10-04 | Not applicable | Working exploit published | SQL injection vulnerability in index.php for MyHelpDesk 20020509, and possibly other versions, allows remote attackers to conduct unauthorized activities via SQL code in the "id" parameter for the operations (1) detailticket, (2) editticket, or (3) updateticketlog. |