Vulnerabilities

TI-2026-51631 CVE-2026-73531 · GHSA-67qv-r9gc-cpwj

django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

LOW 30

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm f…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00286 Published 2026-08-13 Fixed in 2.3.3 CWE-79

TI-2018-15337 CVE-2018-25111 · GHSA-m4jx-m5hg-qrxx

django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.

MEDIUM 56

django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00213 Published 2025-05-31 Fixed in 1.0.0 CWE-277

TI-2021-02891 CVE-2021-3994 · GHSA-2v5j-q74q-r53f

Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk

MEDIUM 44

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01399 Published 2021-12-01 Fixed in 0.3.2 CWE-79

TI-2021-02852 CVE-2021-3950 · GHSA-vfrc-ggmc-5jwv

Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk

LOW 26

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00803 Published 2021-11-19 Fixed in 0.3.1, 0.3.2 CWE-79

TI-2021-02849 CVE-2021-3945 · GHSA-vx6v-xg64-pmr8

Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk

LOW 29

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01008 Published 2021-11-13 Fixed in 0.3.1 CWE-79

Vulnerabilities

Filters

django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.

Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk

Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk

Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk