Read the docs
TI-2022-01174 Aliases CVE-2022-1290GHSA-8p2r-rvjc-5v8f

Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

Why it matters now

EPSS 0.01653 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed polonel/trudesk (polonel): v1.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
polonelpolonel/trudeskbefore v1.2.0v1.2.0Patch availableCNA
  • polonel/trudesk Vendorpolonel Affected before v1.2.0 Fixed in v1.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:trudesk_project:trudesk:*:*:*:*:*:*:*:*before 1.2.0Vulnerablepolonel
  • cpe:2.3:a:trudesk_project:trudesk:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·polonel

Remediation

  • Fix · CNA polonel/trudesk (polonel) Fixed in v1.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1290
  2. 2026-10-03 Alias added: GHSA-8p2r-rvjc-5v8f

References

Exploit 1

Patch 1

  • TI-2026-78782 Username enumeration via regex injection in Trudesk login CVSS 4.0MEDIUM 6.9
  • TI-2026-78773 Authorization bypass in Trudesk ticket API lets users read other tickets CVSS 4.0MEDIUM 6.9
  • TI-2026-78781 Trudesk Missing Authentication for Ticket Attachments via /uploads CVSS 4.0HIGH 8.2
  • TI-2026-78778 Missing authentication on Trudesk debug routes enables data deletion CVSS 4.0HIGH 8.3
  • TI-2026-78777 MongoDB $where injection in Trudesk ticket search API CVSS 4.0HIGH 7.1
  • TI-2021-20836 TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request… CVSS 3.1MEDIUM 6.5
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences