Vulnerabilities

TI-2026-17806 CVE-2026-22196 · GHSA-fwm4-r23r-5x9x

GestSup < 3.2.60 SQL Injection in Ticket Creation

LOW 36

GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00319 Published 2026-01-09 Fixed in 3.2.60 CWE-89

TI-2026-17808 CVE-2026-22198 · GHSA-mr2r-3ff7-jfw5

GestSup < 3.2.60 Stored XSS in API Error Logs

LOW 23

GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00294 Published 2026-01-09 Fixed in 3.2.60 CWE-79

TI-2026-17807 CVE-2026-22197 · GHSA-qv4c-5j2h-4442

GestSup < 3.2.60 Multiple SQL Injections in Asset List

LOW 35

GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00324 Published 2026-01-09 Fixed in 3.2.60 CWE-89

TI-2026-17805 CVE-2026-22195 · GHSA-c5rf-v4g6-p7vf

GestSup < 3.2.60 SQL Injection in Search Bar

LOW 36

GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00319 Published 2026-01-09 Fixed in 3.2.60 CWE-89

TI-2026-17804 CVE-2026-22194 · GHSA-fghm-7m2h-m8rp

GestSup <= 3.2.60 CSRF Allows Privileged Actions

MEDIUM 40

GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests.

CVSS 4.0HIGH 8.9 Network No auth User interaction EPSS 0.00238 Published 2026-01-09 No fix listed CWE-352

TI-2023-28510 CVE-2023-52060 · GHSA-84hr-648m-6p8v

A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily…

MEDIUM 53

A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00258 Published 2024-02-13 No fix listed CWE-352

TI-2023-28509 CVE-2023-52059 · GHSA-94r9-423h-h5m8

A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute…

MEDIUM 58

A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00386 Published 2024-02-13 No fix listed CWE-79

TI-2021-11728 CVE-2021-31646 · GHSA-whcv-8x9m-33fh

Gestsup before 3.2.10 allows account takeover through the password recovery functionality…

MEDIUM 45

Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01339 Published 2021-04-26 No fix listed CWE-307

Vulnerabilities

Filters