Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2025-71419

UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Uvdesk
Products
Community-skeleton Core-framework
CVE-2025-71421

UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Uvdesk
Products
Community-skeleton Core-framework
CVE-2025-71420

UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Uvdesk
Products
Community-skeleton Core-framework