Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
238 results · page 4 of 5
Mar 25, 2022SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk.CVE-2021-35254 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 8.2
SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future.
- Product
- WebHelpDesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comsolarwinds.com
Dec 1, 2021django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3994 · Other software · django-helpdesk · reported by security@huntr.devCritical 9.6
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- django-helpdesk/django-helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3950 · Other software · django-helpdesk · reported by security@huntr.devMedium 5.4
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- django-helpdesk/django-helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2021django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3945 · Other software · django-helpdesk · reported by security@huntr.devMedium 6.1
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- django-helpdesk/django-helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2021Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password.CVE-2021-28024 · Other software · Servicetonic · reported by MITRECritical 9.8
Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a password.
- Product
- Servicetonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicetonic.comsrlabs.de
Nov 8, 2021Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading aCVE-2021-28023 · Other software · Servicetonic · reported by MITRECritical 9.8
Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths.
- Product
- Servicetonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicetonic.comsrlabs.de
Nov 8, 2021Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatibCVE-2021-28022 · Other software · Servicetonic · reported by MITREHigh 7.5
Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries.
- Product
- Servicetonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordservicetonic.comsrlabs.de
Oct 1, 2021Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script CVE-2021-40925 · Other software · Faveohelpdesk · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"] parameter.
- Product
- Faveo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021WordPress Advanced Ticket System, Elite Support Helpdesk: Does not sanitize or escape form values before saving to the database orCVE-2021-24623 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordPress Advanced Ticket System, Elite Support Helpdesk
- Fixed in
- 1.0.64
- What to do
- Update WordPress Advanced Ticket System, Elite Support Helpdesk to 1.0.64 or newer.
Jul 9, 2021Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page anCVE-2021-30119 · Other software · Kaseya · reported by MITREMedium 5.4
Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`
- Product
- VSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Jun 11, 2021An improper access control vulnerability has been reported to affect QNAP NAS.CVE-2021-28814 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.4.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2021The vulnerability have been reported to affect earlier versions of QTS.CVE-2020-2507 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2021QNAP Helpdesk Improper Access Control VulnerabilityCVE-2020-2506 · Network & remote access · QNAP Systems · reported by security@qnapsecurity.com.twExploitedHigh 7.3
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
- Product
- Helpdesk
- On CISA’s list since
- Mar 25, 2022 (federal fix deadline Apr 15, 2022)
- What to do
- Attackers are using this now. Install QNAP Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogqnap.comqnap.com
Dec 21, 2020SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.CVE-2019-16959 · Other software · Solarwinds · reported by MITREMedium 6.5
SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.
- Product
- Webhelpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comesecforte.com
Dec 18, 2020SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.CVE-2019-16957 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.
- Product
- Webhelpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comesecforte.com
Dec 18, 2020SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.CVE-2019-16955 · Other software · Solarwinds · reported by MITREMedium 5.4
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.
- Product
- Webhelpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comesecforte.com
Oct 12, 2020An issue was discovered in HelpDeskZ 1.0.2.CVE-2020-26546 · Other software · Evolutionscript · reported by MITREHigh 7.5
An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Helpdeskz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Sep 11, 2020The vulnerability have been reported to affect earlier versions of Helpdesk.CVE-2018-19948 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow attackers to force NAS users to execute unintentional actions through a web application. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2020The vulnerability have been reported to affect earlier versions of Helpdesk.CVE-2018-19947 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.3
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2020The vulnerability have been reported to affect earlier versions of Helpdesk.CVE-2018-19946 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.2
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020XXE injection can occur in i-net Clear Reports 2019 19.0.287 (Designer), as used in i-net HelpDesk and other products, when XML input containing a reference to CVE-2020-12684 · Other software · Inetsoftware · reported by MITRECritical 9.8
XXE injection can occur in i-net Clear Reports 2019 19.0.287 (Designer), as used in i-net HelpDesk and other products, when XML input containing a reference to an external entity is processed by a weakly configured XML parser.
- Product
- I-net Clear Reports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinetsoftware.deinetsoftware.de
Jul 1, 2020This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service.CVE-2020-2500 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2020Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.CVE-2020-14942 · Other software · Tendenci · reported by MITRECritical 9.8
Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
- Product
- Tendenci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2020The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitCVE-2020-11431 · Other software · Inetsoftware · reported by MITRECritical 9.1
The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitrary system files and directories on the target server via Directory Traversal.
- Product
- Clear Reports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinetsoftware.deinetsoftware.de
May 5, 2020In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances.CVE-2020-11032 · Other software · glpi-project · reported by GitHubHigh 7.6
In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. This is fixed in version 9.4.6.
- Product
- GLPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2020Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help reCVE-2019-20002 · Other software · Solarwinds · reported by MITREHigh 7.8
Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=group TSV export by an admin user.
- Product
- Webhelpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2020An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk).CVE-2020-9758 · Other software · Livezilla · reported by MITRECritical 9.6
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level access, leading to full account takeover. The attack fetches multiple credentials because they are stored in the database (stored XSS). This affects the mobile/chat URI via the lgn and psswrd parameters.
- Product
- Livezilla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2019This improper access control vulnerability in Helpdesk allows attackers to access the system logs.CVE-2018-0728 · Network & remote access · Qnap · reported by security@qnapsecurity.com.twHigh 7.5
This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2019Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter.CVE-2017-18486 · Other software · Jitbit · reported by MITREHigh 7.2
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.
- Product
- Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Apr 9, 2019Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a craftCVE-2018-15640 · Other software · Odoo · reported by security@odoo.comHigh 8.8
Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.
- Product
- Odoo Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2018Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 andCVE-2018-0714 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twCritical 9.8
Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 and their earlier versions could allow remote attackers to run arbitrary commands in the compromised application.
- Product
- Helpdesk in QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2017QNAP has already patched this vulnerability.CVE-2017-13068 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twHigh 7.5
QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain Helpdesk application information. A remote attacker does not require any privileges to successfully execute this attack.
- Product
- QNAP Helpdesk APP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2017Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrCVE-2017-14321 · Other software · Mirasvit · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket.
- Product
- Helpdesk MX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwebshield.huwebshield.hu
Sep 21, 2017Mirasvit Helpdesk MX before 1.5.3 might allow remote attackers to execute arbitrary code by leveraging failure to filter uploaded files.CVE-2017-14320 · Other software · Mirasvit · reported by MITREHigh 8
Mirasvit Helpdesk MX before 1.5.3 might allow remote attackers to execute arbitrary code by leveraging failure to filter uploaded files.
- Product
- Helpdesk MX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwebshield.huwebshield.hu
Sep 20, 2017The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.CVE-2015-4075 · Other software · Helpdeskpro · reported by MITREHigh 8.1
The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task.
- Product
- Helpdesk Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 20, 2017Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a ..CVE-2015-4074 · Other software · Helpdesk Pro Project · reported by MITREHigh 7.5
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
- Product
- Helpdesk Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 20, 2017Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) CVE-2015-4073 · Other software · Helpdesk Pro Project · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL commands via the filter_order parameter.
- Product
- Helpdesk Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 20, 2017Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script orCVE-2015-4072 · Other software · Helpdesk Pro Project · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message.
- Product
- Helpdesk Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 18, 2017The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and nCVE-2015-4071 · Other software · Helpdesk Pro Project · reported by MITREMedium 5.3
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://{target}/component/helpdeskpro/?view=ticket&id={ticketId}.
- Product
- Helpdesk Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 6, 2017public/rolechangeadmin in Faveo 1.9.3 allows CSRF.CVE-2017-7571 · Other software · Ladybirdweb · reported by MITREHigh 8
public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges.
- Product
- Faveo Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrungga.blogspot.co.idsecurityfocus.com
Dec 20, 2013Cross-site scripting (XSS) vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the defaCVE-2013-7191 · Other software · Tenmiles · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Tenmiles Helpdesk Pilot allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI for a ticket.
- Product
- Helpdesk Pilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmakthepla.netsecunia.com
Jul 28, 2010SQL injection vulnerability in the Huru Helpdesk (com_huruhelpdesk) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[CVE-2010-2907 · Other software · Huruhelpdesk · reported by MITREHigh 7.5
SQL injection vulnerability in the Huru Helpdesk (com_huruhelpdesk) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a detail action to index.php.
- Product
- COM Huruhelpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com
Jan 15, 2010SQL injection vulnerability in the Helpdesk (mg_help) extension 1.1.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecCVE-2010-0333 · Other software · Matthias Graubner · reported by MITREHigh 7.5
SQL injection vulnerability in the Helpdesk (mg_help) extension 1.1.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- MG Help
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2010Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id paraCVE-2009-4548 · Other software · Viart · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id parameter to (1) products.php, (2) article.php, (3) product_details.php, or (4) reviews.php; the (5) forum_id parameter to forum.php; or the (6) search_category_id parameter to products_search.php.
- Product
- Viart Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2010Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to inject arbitrary web scCVE-2009-4544 · Other software · Cromosoft · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
- Product
- Facil Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Jan 4, 2010PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code viaCVE-2009-4543 · Other software · Cromosoft · reported by MITREMedium 6.8
PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code via a URL in the lng parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
- Product
- Facil Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Jul 27, 2009Multiple SQL injection vulnerabilities in adminlogin.asp in Zen Help Desk 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) userid (aka uCVE-2009-2604 · Other software · Zenhelpdesk · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in adminlogin.asp in Zen Help Desk 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) userid (aka username) and (2) PassWord parameters to admin.asp.
- Product
- ZEN Help Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexchange.xforce.ibmcloud.com
Apr 7, 2009Multiple cross-site scripting (XSS) vulnerabilities in Web Help Desk 9.1.22 (evaluation version) allow remote attackers to inject arbitrary web script or HTML vCVE-2009-1261 · Other software · Webhelpdesk · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Web Help Desk 9.1.22 (evaluation version) allow remote attackers to inject arbitrary web script or HTML via the (1) Report Name, (2) Asset No., and (3) Full Name fields in a Models action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Web Help Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2009Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a ..CVE-2009-0886 · Other software · Oneorzero · reported by MITREMedium 5
Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter.
- Product
- Oneorzero Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Mar 6, 2009Cerberus Helpdesk before 4.0 (Build 600) allows remote attackers to obtain sensitive information via direct requests for "controllers ...CVE-2008-6440 · Other software · Cerberus · reported by MITREMedium 5
Cerberus Helpdesk before 4.0 (Build 600) allows remote attackers to obtain sensitive information via direct requests for "controllers ... that aren't standard helpdesk pages," possibly involving the (1) /display and (2) /kb URIs.
- Product
- Cerberus Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.