Vulnerabilidades em freescout-help-desk

73 resultados
Análise Vexday

O ecossistema de vulnerabilidades do FreeScout Help Desk acumula 65 CVEs catalogadas, com crescimento expressivo no volume recente — 33 entradas surgiram nos últimos 90 dias, o que indica atenção crescente da comunidade de pesquisa sobre a plataforma. A falha mais prevalente é do tipo CWE-79 (Cross-Site Scripting), padrão consistente com aplicações web de gestão de tickets e que, em ambientes corporativos, pode facilitar sequestro de sessão e movimentação lateral. Nenhuma CVE está atualmente no catálogo KEV da CISA, situando o produto abaixo da média geral de exploração ativa, embora CVE-2026-28289 mereça acompanhamento prioritário dado seu EPSS de 0,3114 — o mais alto do conjunto — e a existência de PoC pública circulando. As 6 CVEs de severidade crítica reforçam a necessidade de ciclos de patching disciplinados, especialmente diante da velocidade com que novas entradas têm sido registradas.

CVE-2026-28289CRITICALFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionEPSS 31.1%CVE-2026-27636HIGHFreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on ApacheEPSS 2.1%CVE-2025-54366HIGHFreeScout's deserialization of untrusted data leads to Remote Code ExecutionEPSS 1.0%CVE-2025-48471HIGHFreeScout Vulnerable to Arbitrary File UploadEPSS 1.0%CVE-2025-48389HIGHFreeScout Vulnerable to Deserialization of Untrusted DataEPSS 0.8%CVE-2025-48390HIGHFreeScout Vulnerable to Remote Code Execution (RCE)EPSS 0.8%CVE-2025-58163HIGHFreeScout's deserialization of untrusted data can lead to Remote Code ExecutionEPSS 0.7%CVE-2026-27637CRITICALFreeScout's Predictable Authentication Token Enables Account TakeoverEPSS 0.7%CVE-2026-40498HIGHFreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cronEPSS 0.6%CVE-2026-32754CRITICALFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})EPSS 0.5%CVE-2025-48481MEDIUMFreeScout Has Business Logic ErrorsEPSS 0.5%CVE-2025-48476HIGHFreeScout Has Business Logic ErrorsEPSS 0.4%CVE-2025-48477HIGHFreeScout Has Business Logic ErrorsEPSS 0.4%CVE-2025-48474MEDIUMFreeScout Vulnerable to Insufficient AuthorizationEPSS 0.4%CVE-2026-40496HIGHFreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute ForceEPSS 0.4%CVE-2025-48478HIGHFreeScout Has Business Logic ErrorsEPSS 0.4%CVE-2026-41193CRITICALFreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCEEPSS 0.4%CVE-2026-53595CRITICALFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLEPSS 0.4%CVE-2026-48812HIGHFreeScout Allows Unauthenticated Access to Legacy Attachment FilesEPSS 0.4%CVE-2025-48472MEDIUMFreeScout Vulnerable to Insufficient AuthorizationEPSS 0.4%