CVE-2024-13606: falha de alta gravidade em rabilal JS Help Desk – AI-Powered Support &…
JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.4%
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
rabilal · JS Help Desk – AI-Powered Support & Ticketing SystemCVEs relacionadas — rabilal JS Help Desk – AI-Powered Support &…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-7094CRITICALJS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code ExecutionEPSS 37.6%CVE-2023-7337HIGHJS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' CookieEPSS 1.4%CVE-2026-104739MEDIUMJS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' ParameterEPSS 0.8%CVE-2024-13607MEDIUMJS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object ReferenceEPSS 0.4%CVE-2026-2511HIGHJS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' ParameterEPSS 0.3%CVE-2026-118046MEDIUMJS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-titleEPSS 0.2%