Zucchetti vulnerabilities
We track 4 vulnerabilities in Zucchetti products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 11, 2025.
Latest Zucchetti vulnerabilities
- 7.6 High severity
Ad Hoc Infinity: URL Redirection to Untrusted Site
In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication.
- 7.3 High severity
Ad Hoc Infinity: Improper Control of Filename for Include/Require Statement in PHP Program
A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimg_upload.jsp.
- 8.1 High severity
Helpdeskadvanced: Improper Preservation of Permissions
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users by sending a request to the "WSCView/Delete" function.
- 8.8 High severity
Helpdeskadvanced: Improper Preservation of Permissions
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a request to the "AclList/SaveAclRules" administrative function.