Opensupports Opensupports
4 CVEs affecting Opensupports Opensupports. Latest disclosed: 2025-10-03. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48031 | Critical | 9.8 | 2023-11-17 | OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions an… |
CVE-2025-10696 | Medium | 5.4 | 2025-10-03 | OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the own… |
CVE-2025-10695 | Medium | 5.3 | 2025-10-03 | Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed… |
CVE-2025-10692 | | 2025-10-03 | The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter bindi… |