Vulnerabilidades en freescout-help-desk
85 resultadosCVE-2025-48880MEDIUMFreeScout has Race Condition When Deleting UsersEPSS 0.4%CVE-2025-48475MEDIUMFreeScout Vulnerable to Insufficient AuthorizationEPSS 0.4%CVE-2026-40496HIGHFreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute ForceEPSS 0.4%CVE-2025-48388HIGHFreeScout Has Insufficient Protection Against CRLF-injectionEPSS 0.4%CVE-2026-103984MEDIUMFreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PIIEPSS 0.4%CVE-2026-41193CRITICALFreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCEEPSS 0.4%CVE-2025-48473MEDIUMFreeScout Vulnerable to Insufficient AuthorizationEPSS 0.4%CVE-2025-48482MEDIUMFreeScout Has Business Logic ErrorsEPSS 0.4%CVE-2026-53593HIGHFreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471EPSS 0.4%CVE-2025-48479HIGHFreeScout Has Business Logic ErrorsEPSS 0.3%CVE-2025-48480HIGHFreeScout Has Business Logic ErrorsEPSS 0.3%CVE-2026-35584MEDIUMFreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and EnumerationEPSS 0.3%CVE-2026-103985HIGHFreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile saveEPSS 0.3%CVE-2026-40569CRITICALFreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email ExfiltrationEPSS 0.3%CVE-2026-32752NONEFreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer MessagesEPSS 0.3%CVE-2026-40566MEDIUMFreeScout vulnerable to SSRF via IMAP/SMTP Connection Test EndpointsEPSS 0.3%CVE-2026-34443MEDIUMFreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()EPSS 0.3%CVE-2026-53596MEDIUMFreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)EPSS 0.3%CVE-2026-62850MEDIUMFreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secretsEPSS 0.3%CVE-2025-48488MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%