TI-2025-13340 CVE-2025-14600 · GHSA-r87r-w586-7rg3
Admin Account Takeover via Path Traversal in vsDesk
Priority MEDIUM 49
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access.
vsDesk
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
vsDesk records in CISA KEVNo vsDesk vulnerabilities are listed in CISA KEV.
Records
5 records
TI-2026-01974 CVE-2026-2334 · GHSA-cxgp-6h9c-hfpc
) Missing Server-Side File Extension Validation in vsDesk
Priority MEDIUM 44
An issue was discovered in vsDesk v14.0101.
TI-2025-13343 CVE-2025-14603 · GHSA-76p9-g6m2-hj7q
Use of user input in raw SQL queries in vsDesk leading to blind SQL injection
Priority MEDIUM 44
The application component processes user-supplied parameters insecurely, passing them into SQL queries.
TI-2025-13341 CVE-2025-14601 · GHSA-mjxg-34vj-37wc
vsDesk Task Scheduler OS Command Injection
Priority MEDIUM 41
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering.
TI-2025-13342 CVE-2025-14602 · GHSA-2vv3-69qg-3hgr
Weak File Name Generation in vsDesk
Priority LOW 24
The application generates uploaded file names using a weak and predictable method based on the request timestamp.