VendorsTrudesk Projecttrudeskany version

Vulnerabilities

Trudesk Project Trudesk any version

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

29CVEs

Incorrect Use of Privileged APIs in polonel/trudesk

Published 2022-06-20 · Modified

10.0EPSS 0.033

Improper Privilege Management in polonel/trudesk

Published 2022-05-20 · Modified

9.9EPSS 0.026

Unrestricted Upload of File with Dangerous Type in polonel/trudesk

Published 2022-06-20 · Modified

9.8EPSS 0.029

Weak Password Requirements in polonel/trudesk

Published 2022-05-20 · Modified

9.8EPSS 0.022

Incorrect Synchronization in polonel/trudesk

Published 2022-05-31 · Modified

9.1EPSS 0.017

Use of Incorrect Operator in polonel/trudesk

Published 2022-05-31 · Modified

9.1EPSS 0.013

Unrestricted Upload of File with Dangerous Type in polonel/trudesk

Published 2022-05-21 · Modified

9.0EPSS 0.019

Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk

Published 2022-04-10 · Modified

9.0EPSS 0.017

Stored XSS viva .svg file upload in polonel/trudesk

Published 2022-04-11 · Modified

9.0EPSS 0.016

Execution with Unnecessary Privileges in polonel/trudesk

Published 2022-05-31 · Modified

8.8EPSS 0.038

Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk

Published 2022-05-20 · Modified

8.4EPSS 0.016

Integer Overflow or Wraparound in polonel/trudesk

Published 2022-05-20 · Modified

8.4EPSS 0.010

CVE-2026-114397

Trudesk through 1.2.11 Missing Authentication on Debug Routes

Published 2026-10-21 · Analyzed

8.3EPSS 0.006

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk

Published 2022-05-12 · Modified

8.2EPSS 0.009

CVE-2026-114400

Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

Published 2026-10-21 · Analyzed

8.2EPSS 0.005

Integer Overflow or Wraparound in polonel/trudesk

Published 2022-05-31 · Modified

7.6EPSS 0.010

Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk

Published 2022-05-16 · Modified

7.6EPSS 0.010

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk

Published 2022-05-16 · Modified

7.5EPSS 0.011

CVE-2026-114396

Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

Published 2026-10-21 · Analyzed

7.1EPSS 0.005

CVE-2026-114399

Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

Published 2026-10-21 · Analyzed

7.0EPSS 0.006

CVE-2026-114401

Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

Published 2026-10-21 · Analyzed

6.9EPSS 0.004

CVE-2026-114392

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid

Published 2026-10-21 · Analyzed

6.9EPSS 0.004

Reflected XSS on ticket filter function in polonel/trudesk

Published 2022-05-16 · Modified

5.5EPSS 0.007

CVE-2026-114398

Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo

Published 2026-10-21 · Analyzed

5.4EPSS 0.003

Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk

Published 2022-05-31 · Modified

5.3EPSS 0.008

CVE-2026-114402

Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload

Published 2026-10-21 · Analyzed

5.3EPSS 0.004

CVE-2026-114393

Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints

Published 2026-10-21 · Analyzed

5.3EPSS 0.003

CVE-2026-114394

Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

Published 2026-10-21 · Analyzed

5.3EPSS 0.003

CVE-2026-114395

Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

Published 2026-10-21 · Analyzed

5.3EPSS 0.003