Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: uvdesk community-skeleton, core-framework 1.1.7, 1.1.8 Clear all filters
TI-2025-43532 CVE-2025-71421 · GHSA-hvr3-jhx6-xw68

UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

Priority MEDIUM 40

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00639 Published 2026-09-21 Fixed in 1.1.7, 1.1.8 CWE-269
TI-2025-43531 CVE-2025-71420 · GHSA-gvmp-wwrp-jm4j

UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply

Priority MEDIUM 57

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00416 Published 2026-09-21 Fixed in 1.1.7, 1.1.8 CWE-639
TI-2025-43530 CVE-2025-71419 · GHSA-vv73-x849-w3gg

UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer

Priority LOW 23

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00321 Published 2026-09-21 Fixed in 1.1.7, 1.1.8 CWE-79