Uvdesk Community-Skeleton
8 CVEs affecting Uvdesk Community-Skeleton. Latest disclosed: 2026-09-21. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92805 | Critical | 9.8 | 2026-09-16 | UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unaut… |
CVE-2023-37635 | Critical | 9.8 | 2023-10-23 | UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application. |
CVE-2023-0265 | High | 8.8 | 2023-04-04 | Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly vali… |
CVE-2025-71421 | High | 7.2 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management p… |
CVE-2023-0325 | Medium | 6.1 | 2023-04-04 | Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not co… |
CVE-2025-71419 | Medium | 5.4 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMail… |
CVE-2023-1197 | Medium | 4.8 | 2023-03-06 | Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0. |
CVE-2025-71420 | Medium | 4.3 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replie… |