freescout-help-desk

Records91All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high40CVSS 7.0–8.9

Exploited now

freescout-help-desk records in CISA KEV

No freescout-help-desk vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Freescout 46 records HIGH

Records

91 records

TI-2026-38652 CVE-2026-53595

FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

HIGH 82

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.01945 Published 2026-07-20 Fixed in 1.8.224 CWE-178

TI-2026-22019 CVE-2026-27637

FreeScout's Predictable Authentication Token Enables Account Takeover

HIGH 82

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0076 Published 2026-02-25 Fixed in 1.8.206 CWE-330

TI-2026-30304 CVE-2026-41902

FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks

HIGH 80

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00246 Published 2026-05-07 Fixed in 1.8.217 CWE-613

TI-2026-29249 CVE-2026-40498

FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron

HIGH 80

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00571 Published 2026-04-21 Fixed in 1.8.213 CWE-200

TI-2026-29247 CVE-2026-40496

FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force

HIGH 77

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00403 Published 2026-04-21 Fixed in 1.8.213 CWE-330

TI-2026-38648 CVE-2026-53591

FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails

HIGH 76

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00265 Published 2026-07-20 Fixed in 1.8.223 CWE-287

TI-2026-25245 CVE-2026-32754

FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})

HIGH 75

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.0056 Published 2026-03-19 Fixed in 1.8.209 CWE-116

TI-2026-29815 CVE-2026-41193

FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE

HIGH 74

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00392 Published 2026-04-21 Fixed in 1.8.215 CWE-22

TI-2026-29310 CVE-2026-40569

FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration

HIGH 74

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.00296 Published 2026-04-21 Fixed in 1.8.213 CWE-284

TI-2026-22596 CVE-2026-28289

FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution

HIGH 74

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.35103 Published 2026-03-03 Fixed in 1.8.207 CWE-434

TI-2024-19354 CVE-2024-29185

FreeScout OS Command Injection vulnerability

HIGH 74

FreeScout is a self-hosted help desk and shared mailbox.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01731 Published 2024-03-22 Fixed in 1.8.128 CWE-78

TI-2026-38650 CVE-2026-53593

Unrestricted file upload in freescout-help-desk freescout

HIGH 73

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00351 Published 2026-07-20 Fixed in 1.8.224 CWE-434

TI-2026-22018 CVE-2026-27636

FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache

HIGH 73

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02218 Published 2026-02-25 Fixed in 1.8.206 CWE-434

TI-2026-36081 CVE-2026-48812

FreeScout Allows Unauthenticated Access to Legacy Attachment Files

HIGH 72

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00472 Published 2026-07-20 Fixed in 1.8.221 CWE-287

TI-2026-25244 CVE-2026-32753

FreeScout: Stored XSS through SVG file upload with filter bypass

HIGH 72

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.0022 Published 2026-03-19 Fixed in 1.8.209 CWE-80

TI-2026-29309 CVE-2026-40568

FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization

HIGH 70

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00238 Published 2026-04-21 Fixed in 1.8.213 CWE-116

TI-2026-29248 CVE-2026-40497

FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)

HIGH 70

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00243 Published 2026-04-21 Fixed in 1.8.213 CWE-79

TI-2026-27687 CVE-2026-35584

Missing authentication in freescout-help-desk freescout

HIGH 70

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00316 Published 2026-04-07 Fixed in 1.8.212 CWE-306

TI-2025-34179 CVE-2025-54366

FreeScout's deserialization of untrusted data leads to Remote Code Execution

HIGH 70

FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework).

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01133 Published 2025-07-26 Fixed in 1.8.186 CWE-502

TI-2025-30751 CVE-2025-48472

FreeScout Vulnerable to Insufficient Authorization

HIGH 70

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00414 Published 2025-05-29 Fixed in 1.8.179 CWE-863

TI-2026-33095 CVE-2026-45295

Authorization bypass in freescout-help-desk freescout

HIGH 68

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00239 Published 2026-07-20 Fixed in 1.8.219 CWE-639

TI-2026-30307 CVE-2026-41905

Server-side request forgery in freescout-help-desk freescout

HIGH 67

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00209 Published 2026-05-07 Fixed in 1.8.217 CWE-918

TI-2026-34715 CVE-2026-47123

FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path

HIGH 66

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00145 Published 2026-05-29 Fixed in 1.8.220 CWE-290

TI-2026-29325 CVE-2026-40589

FreeScout has Customer Edit Cross-Mailbox Email Takeover

HIGH 66

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00236 Published 2026-04-21 Fixed in 1.8.214 CWE-639

TI-2026-28369 CVE-2026-39384

FreeScout Customer Merge Cross-Mailbox Authorization Bypass

HIGH 66

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00244 Published 2026-04-07 Fixed in 1.8.212 CWE-639

Open these records in search →