Vulnerabilities

TI-2026-29306 CVE-2026-40565

FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href

MEDIUM 60

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00199 Published 2026-04-21 Fixed in 1.8.213 CWE-79

TI-2026-29249 CVE-2026-40498

FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron

HIGH 80

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00571 Published 2026-04-21 Fixed in 1.8.213 CWE-200

TI-2026-29248 CVE-2026-40497

FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)

HIGH 70

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00243 Published 2026-04-21 Fixed in 1.8.213 CWE-79

TI-2026-29247 CVE-2026-40496

FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force

HIGH 77

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00403 Published 2026-04-21 Fixed in 1.8.213 CWE-330

TI-2026-27687 CVE-2026-35584

Missing authentication in freescout-help-desk freescout

HIGH 70

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00316 Published 2026-04-07 Fixed in 1.8.212 CWE-306

TI-2026-28369 CVE-2026-39384

FreeScout Customer Merge Cross-Mailbox Authorization Bypass

HIGH 66

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00244 Published 2026-04-07 Fixed in 1.8.212 CWE-639

TI-2026-26707 CVE-2026-34442

FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

MEDIUM 60

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-03-31 Fixed in 1.8.211 CWE-20

TI-2026-26708 CVE-2026-34443

FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()

LOW 36

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00288 Published 2026-03-31 Fixed in 1.8.211 CWE-918

TI-2026-25245 CVE-2026-32754

FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})

HIGH 75

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.0056 Published 2026-03-19 Fixed in 1.8.209 CWE-116

TI-2026-25244 CVE-2026-32753

FreeScout: Stored XSS through SVG file upload with filter bypass

HIGH 72

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.0022 Published 2026-03-19 Fixed in 1.8.209 CWE-80

TI-2026-25243 CVE-2026-32752

FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages

MEDIUM 41

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00294 Published 2026-03-19 Fixed in 1.8.209 CWE-284

TI-2026-22596 CVE-2026-28289

FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution

HIGH 74

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.35103 Published 2026-03-03 Fixed in 1.8.207 CWE-434

TI-2026-22018 CVE-2026-27636

FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache

HIGH 73

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02218 Published 2026-02-25 Fixed in 1.8.206 CWE-434

TI-2026-22019 CVE-2026-27637

FreeScout's Predictable Authentication Token Enables Account Takeover

HIGH 82

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0076 Published 2026-02-25 Fixed in 1.8.206 CWE-330

TI-2025-35979 CVE-2025-58163

FreeScout's deserialization of untrusted data can lead to Remote Code Execution

MEDIUM 40

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00721 Published 2025-09-03 Fixed in 1.8.186 CWE-502

TI-2025-34179 CVE-2025-54366

FreeScout's deserialization of untrusted data leads to Remote Code Execution

HIGH 70

FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework).

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01133 Published 2025-07-26 Fixed in 1.8.186 CWE-502

TI-2025-30767 CVE-2025-48488

FreeScout Vulnerable to Stored XSS

LOW 21

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00271 Published 2025-05-30 Fixed in 1.8.180 CWE-79

TI-2025-31030 CVE-2025-48880

FreeScout has Race Condition When Deleting Users

MEDIUM 56

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0041 Published 2025-05-30 Fixed in 1.8.181 CWE-362

TI-2025-31026 CVE-2025-48875

FreeScout Vulnerable to Stored XSS

LOW 21

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00261 Published 2025-05-30 Fixed in 1.8.181 CWE-79

TI-2025-30768 CVE-2025-48489

FreeScout Vulnerable to Stored XSS

LOW 21

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00235 Published 2025-05-30 Fixed in 1.8.180 CWE-79

TI-2025-30766 CVE-2025-48487

FreeScout Vulnerable to Stored XSS

MEDIUM 60

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 6.0 Network High privileges User interaction EPSS 0.00271 Published 2025-05-30 Fixed in 1.8.180 CWE-79

TI-2025-30765 CVE-2025-48486

FreeScout Vulnerable to Stored XSS

LOW 27

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00271 Published 2025-05-30 Fixed in 1.8.180 CWE-79

TI-2025-30764 CVE-2025-48485

FreeScout Vulnerable to Stored XSS

LOW 27

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 6.1 Network Low privileges User interaction EPSS 0.0027 Published 2025-05-30 Fixed in 1.8.180 CWE-79

TI-2025-30763 CVE-2025-48484

FreeScout Vulnerable to Stored XSS

LOW 21

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00271 Published 2025-05-30 Fixed in 1.8.178 CWE-79

TI-2025-30762 CVE-2025-48483

FreeScout Stored XSS leads to CSRF

LOW 27

FreeScout is a free self-hosted help desk and shared mailbox.

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00158 Published 2025-05-30 Fixed in 1.8.180 CWE-352

Vulnerabilities

Filters