FR
Vendor
freescout-help-desk
74
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107393 | FR freescout freescout-help-desk | 6.1 | Oct 8 | FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header |
| CVE-2026-53596 | FR freescout freescout-help-desk | 5.3 | Jul 20 | FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS) |
| CVE-2026-53595 | FR freescout freescout-help-desk | 9.4 | Jul 20 | FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL |
| CVE-2026-53594 | FR freescout freescout-help-desk | 4.9 | Jul 20 | FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path |
| CVE-2026-53593 | FR freescout freescout-help-desk | 8.8 | Jul 20 | FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471 |
| CVE-2026-53592 | FR freescout freescout-help-desk | 4.6 | Jul 20 | FreeScout vulnerable to prototype pollution in getQueryParam |
| CVE-2026-53591 | FR freescout freescout-help-desk | 8.6 | Jul 20 | FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails |
| CVE-2026-48812 | FR freescout freescout-help-desk | 7.5 | Jul 20 | FreeScout Allows Unauthenticated Access to Legacy Attachment Files |
| CVE-2026-45295 | FR freescout freescout-help-desk | 6.5 | Jul 20 | FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint |
| CVE-2026-45294 | FR freescout freescout-help-desk | 5.3 | May 29 | FreeScout: User Account Enumeration via Password Reset Response Differentiation |
| CVE-2026-47123 | FR freescout freescout-help-desk | 7.5 | May 29 | FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path |
| CVE-2026-48810 | FR freescout freescout-help-desk | 4.3 | May 29 | FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check |
| CVE-2026-48811 | FR freescout freescout-help-desk | 4.3 | May 29 | FreeScout: Thread Deletion Bypasses Mailbox Access Revocation |
| CVE-2026-41906 | FR freescout freescout-help-desk | 7.1 | May 7 | FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass |
| CVE-2026-41905 | FR freescout freescout-help-desk | 7.7 | May 7 | FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access |
| CVE-2026-41904 | FR freescout freescout-help-desk | 7.6 | May 7 | FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip_tags validator with mixed text+HTML content |
| CVE-2026-41902 | FR freescout freescout-help-desk | 9.1 | May 7 | FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks |
| CVE-2026-41903 | FR freescout freescout-help-desk | 5.4 | May 7 | FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472) |
| CVE-2026-41194 | FR freescout freescout-help-desk | 5.4 | Apr 21 | FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable |
| CVE-2026-41193 | FR freescout freescout-help-desk | 9.1 | Apr 21 | FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE |
| CVE-2026-41192 | FR freescout freescout-help-desk | 7.1 | Apr 21 | FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments |
| CVE-2026-41191 | FR freescout freescout-help-desk | 7.1 | Apr 21 | FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes |
| CVE-2026-41190 | FR freescout freescout-help-desk | 7.1 | Apr 21 | FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection |
| CVE-2026-41189 | FR freescout freescout-help-desk | 7.1 | Apr 21 | FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads |
| CVE-2026-41183 | FR freescout freescout-help-desk | 4.3 | Apr 21 | FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations |
| CVE-2026-40592 | FR freescout freescout-help-desk | 5.9 | Apr 21 | FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply |
| CVE-2026-40591 | FR freescout freescout-help-desk | 7.1 | Apr 21 | FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification |
| CVE-2026-40590 | FR freescout freescout-help-desk | 4.3 | Apr 21 | FreeScout's Customer AJAX Create Modifies Hidden Existing Customer |
| CVE-2026-40589 | FR freescout freescout-help-desk | 7.6 | Apr 21 | FreeScout has Customer Edit Cross-Mailbox Email Takeover |
| CVE-2026-40570 | FR freescout freescout-help-desk | 5.7 | Apr 21 | FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII |
| CVE-2026-40569 | FR freescout freescout-help-desk | 9.0 | Apr 21 | FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration |
| CVE-2026-40568 | FR freescout freescout-help-desk | 8.5 | Apr 21 | FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization |
| CVE-2026-40567 | FR freescout freescout-help-desk | 5.8 | Apr 21 | FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables |
| CVE-2026-40566 | FR freescout freescout-help-desk | 4.1 | Apr 21 | FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints |
| CVE-2026-40565 | FR freescout freescout-help-desk | 6.1 | Apr 21 | FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href |
| CVE-2026-40498 | FR freescout freescout-help-desk | 9.8 | Apr 21 | FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron |
| CVE-2026-40497 | FR freescout freescout-help-desk | 8.1 | Apr 21 | FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration) |
| CVE-2026-40496 | FR freescout freescout-help-desk | 9.1 | Apr 21 | FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force |
| CVE-2026-35584 | FR freescout freescout-help-desk | 6.5 | Apr 7 | FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration |
| CVE-2026-39384 | FR freescout freescout-help-desk | 7.6 | Apr 7 | FreeScout Customer Merge Cross-Mailbox Authorization Bypass |
| CVE-2026-34442 | FR freescout freescout-help-desk | 6.1 | Mar 31 | FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout |
| CVE-2026-34443 | FR freescout freescout-help-desk | 5.3 | Mar 31 | FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask() |
| CVE-2026-32754 | FR freescout freescout-help-desk | 9.3 | Mar 19 | FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) |
| CVE-2026-32753 | FR freescout freescout-help-desk | 5.4 | Mar 19 | FreeScout: Stored XSS through SVG file upload with filter bypass |
| CVE-2026-32752 | FR freescout freescout-help-desk | 8.1 | Mar 19 | FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages |
| CVE-2026-28289 | FR freescout freescout-help-desk | 8.1 | Mar 3 | FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution |
| CVE-2026-27636 | FR freescout freescout-help-desk | 8.8 | Feb 25 | FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache |
| CVE-2026-27637 | FR freescout freescout-help-desk | 9.8 | Feb 25 | FreeScout's Predictable Authentication Token Enables Account Takeover |
| CVE-2025-58163 | FR freescout freescout-help-desk | 8.8 | Sep 3 | FreeScout's deserialization of untrusted data can lead to Remote Code Execution |
| CVE-2025-54366 | FR freescout freescout-help-desk | 8.8 | Jul 26 | FreeScout's deserialization of untrusted data leads to Remote Code Execution |
| CVE-2025-48488 | FR freescout freescout-help-desk | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS |
| CVE-2025-48880 | FR freescout freescout-help-desk | 6.6 | May 30 | FreeScout has Race Condition When Deleting Users |
| CVE-2025-48875 | FR freescout freescout-help-desk | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS |
| CVE-2025-48489 | FR freescout freescout-help-desk | 4.8 | May 30 | FreeScout Vulnerable to Stored XSS |
| CVE-2025-48487 | FR freescout freescout-help-desk | 4.8 | May 30 | FreeScout Vulnerable to Stored XSS |
| CVE-2025-48486 | FR freescout freescout-help-desk | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS |
| CVE-2025-48485 | FR freescout freescout-help-desk | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS |
| CVE-2025-48484 | FR freescout freescout-help-desk | 5.4 | May 30 | FreeScout Vulnerable to Stored XSS |
| CVE-2025-48483 | FR freescout freescout-help-desk | 5.4 | May 30 | FreeScout Stored XSS leads to CSRF |
| CVE-2025-48482 | FR freescout freescout-help-desk | 4.3 | May 30 | FreeScout Has Business Logic Errors |