Polonel vulnerabilities
We track 4 vulnerabilities in Polonel products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2026.
Latest Polonel vulnerabilities
- 7.5 High severity
trudesk: Files or Directories Accessible to External Parties
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, a
- 7.4 High severity
trudesk: Initialization of a Resource with an Insecure Default
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then
- 7.1 High severity
trudesk: Improper Neutralization of Special Elements in Data Query Logic
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to l
- 7.5 High severity
polonel/trudesk: Integer Overflow or Wraparound
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can l