Uvdesk vulnerabilities
We track 3 vulnerabilities in Uvdesk products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 21, 2026.
Latest Uvdesk vulnerabilities
- 7.2 High severity
core-framework: Improper Privilege Management
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifi
- 9.8 Critical severity
community-skeleton: Missing Authentication for Critical Functionality
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting c
- 8.8 High severity
Uvdesk: Unrestricted Upload of File with Dangerous Type
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.