Vulnerabilities in freescout-help-desk
85 resultsCVE-2026-28289CRITICALFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionEPSS 35.1%CVE-2026-27636HIGHFreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on ApacheEPSS 2.2%CVE-2026-53595CRITICALFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLEPSS 1.9%CVE-2025-48471HIGHFreeScout Vulnerable to Arbitrary File UploadEPSS 1.2%CVE-2025-54366HIGHFreeScout's deserialization of untrusted data leads to Remote Code ExecutionEPSS 1.1%CVE-2025-48389HIGHFreeScout Vulnerable to Deserialization of Untrusted DataEPSS 1.0%CVE-2025-48390HIGHFreeScout Vulnerable to Remote Code Execution (RCE)EPSS 1.0%CVE-2026-27637CRITICALFreeScout's Predictable Authentication Token Enables Account TakeoverEPSS 0.8%CVE-2025-58163HIGHFreeScout's deserialization of untrusted data can lead to Remote Code ExecutionEPSS 0.7%CVE-2026-40498HIGHFreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cronEPSS 0.6%CVE-2025-48481MEDIUMFreeScout Has Business Logic ErrorsEPSS 0.6%CVE-2025-48476HIGHFreeScout Has Business Logic ErrorsEPSS 0.6%CVE-2026-32754CRITICALFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})EPSS 0.6%CVE-2025-48477HIGHFreeScout Has Business Logic ErrorsEPSS 0.5%CVE-2025-48474MEDIUMFreeScout Vulnerable to Insufficient AuthorizationEPSS 0.5%CVE-2026-48812HIGHFreeScout Allows Unauthenticated Access to Legacy Attachment FilesEPSS 0.5%CVE-2025-48478HIGHFreeScout Has Business Logic ErrorsEPSS 0.5%CVE-2026-62855MEDIUMFreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local FilesEPSS 0.5%CVE-2026-53594MEDIUMFreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted PathEPSS 0.4%CVE-2025-48472MEDIUMFreeScout Vulnerable to Insufficient AuthorizationEPSS 0.4%