Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-111708

WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Canove
Products
Whaticket-community
CVE-2026-111709

WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canove
Products
Whaticket-community