Priority LOW 39
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement.
CVSS 4.0HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.003 · Published 2026-10-15 · Fixed in 6.5.25, 7.3.7 CWE-89
Priority MEDIUM 42
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header.
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.00234 · Published 2026-10-15 · Fixed in 6.5.25, 7.3.7 CWE-348
Priority LOW 22
Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00242 · Published 2026-08-20 · Fixed in 6.5.22 CWE-79
Priority LOW 27
In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communication log administration view).
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00148 · Published 2026-06-05 · Fixed in 6.5.21, 7.3.3 CWE-79
Priority LOW 23
In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00133 · Published 2026-06-05 · Fixed in 6.5.21, 7.3.3 CWE-79
Priority MEDIUM 49
An issue was discovered in Znuny before 7.1.4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00431 · Published 2025-05-12 · No fix listed CWE-862
Priority LOW 27
An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00244 · Published 2025-05-08 · No fix listed CWE-79
Priority MEDIUM 45
An issue was discovered in Znuny before 7.1.5.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00409 · Published 2025-05-08 · No fix listed CWE-521
Priority MEDIUM 49
An Eval Injection issue was discovered in Znuny through 7.1.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00512 · Published 2025-05-08 · No fix listed CWE-95
Priority MEDIUM 49
An issue was discovered in Znuny through 7.1.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00439 · Published 2025-05-08 · No fix listed CWE-1004
Priority LOW 39
An issue was discovered in Znuny through 7.1.3.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00369 · Published 2025-05-08 · No fix listed CWE-863
Priority LOW 34
Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00593 · Published 2024-10-11 · No fix listed CWE-1333
Priority LOW 27
Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00401 · Published 2024-10-11 · No fix listed CWE-79
Priority LOW 39
An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able to inject SQL in the draft form ID parameter of an AJAX request.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00708 · Published 2024-04-29 · No fix listed CWE-89
Priority LOW 34
An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00532 · Published 2024-04-29 · No fix listed CWE-94
Priority MEDIUM 44
An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in user can upload a file (via a manipulated AJAX Request) to an arbitrary writable location by traversing…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00719 · Published 2024-04-29 · No fix listed CWE-94
THREATIST.IORead the docs