Freescout-helpdesk vulnerabilities
We track 4 vulnerabilities in Freescout-helpdesk products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2024.
Latest Freescout-helpdesk vulnerabilities
- 9.1 Critical severity
freescout: Session Fixation
The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session token can be sent to the /auth endpoint. NOTE: this module is not part of freescout-helpdesk/freescout on GitHub.
- 9.0 Critical severity
freescout: Improper Neutralization of Special Elements used in an OS Command
FreeScout is a self-hosted help desk and shared mailbox. Versions prior to 1.8.128 are vulnerable to OS Command Injection in the /public/tools.php source file. The value of the php_path parameter is being executed as an OS command by the shell_exec function, w
- 8.0 High severity
freescout: Improper Neutralization of Input During Web Page Generation
FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting (XSS) vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not prop
- 7.1 High severity
freescout: Insertion of Sensitive Information into Log File
FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue a