Uvdesk

9 CVEs across 3 Uvdesk products. Browse Uvdesk vulnerabilities, severities, and proof-of-concept exploits.

Uvdesk products with known CVEs

ProductCVEs
Community-Skeleton8
Uvdesk/community-Skeleton2
Core-Framework1
Uvdesk CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-71421High7.22026-09-21UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management p…
CVE-2025-71420Medium4.32026-09-21UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replie…
CVE-2025-71419Medium5.42026-09-21UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMail…
CVE-2026-92805Critical9.82026-09-16UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unaut…
CVE-2024-3137High7.12024-04-02Improper Privilege Management in uvdesk/community-skeleton
CVE-2023-37635Critical9.82023-10-23UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.
CVE-2023-0325Medium6.12023-04-04Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not co…
CVE-2023-0265High8.82023-04-04Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly vali…
CVE-2023-1197Medium4.82023-03-06Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.