Vendors / GestSup Records 12 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 5
Exploited now GestSup records in CISA KEV No GestSup vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 58
A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00386 · Published 2024-02-13 · No fix listed CWE-79
Priority MEDIUM 53
A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request.
CVSS 3.1 MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00258 · Published 2024-02-13 · No fix listed CWE-352
Priority MEDIUM 45
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote).
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01339 · Published 2021-04-26 · No fix listed CWE-307
Priority MEDIUM 40
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests.
CVSS 4.0 HIGH 8.9· Network · No auth · User interaction · EPSS 0.00238 · Published 2026-01-09 · No fix listed CWE-352
Priority LOW 36
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality.
CVSS 4.0 HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00319 · Published 2026-01-09 · Fixed in 3.2.60 CWE-89
Priority LOW 36
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality.
CVSS 4.0 HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00319 · Published 2026-01-09 · Fixed in 3.2.60 CWE-89
Priority LOW 35
GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality.
CVSS 4.0 HIGH 7.5· Network · High privileges · No interaction · EPSS 0.00324 · Published 2026-01-09 · Fixed in 3.2.60 CWE-89
Priority LOW 23
GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00294 · Published 2026-01-09 · Fixed in 3.2.60 CWE-79
Open these records in search → All records by CVSS severity
2 5 5 0 0
THREATIST.IORead the docs