What’s Vulnerable › Products

polonel/trudesk vulnerabilities

32 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your polonel/trudesk version is affected

Latest polonel/trudesk vulnerabilities

• CVE-2026-114402 — Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload (CVSS 4.3)
• CVE-2026-114401 — Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login (CVSS 5.3)
• CVE-2026-114400 — Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads (CVSS 7.5)
• CVE-2026-114399 — Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API (CVSS 6.5)
• CVE-2026-114397 — Trudesk through 1.2.11 Missing Authentication on Debug Routes (CVSS 7.4)
• CVE-2026-114396 — Trudesk through 1.2.11 MongoDB $where Injection via tickets search API (CVSS 7.1)
• CVE-2026-114395 — Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send (CVSS 4.3)
• CVE-2026-114394 — Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs (CVSS 4.3)
• CVE-2026-114392 — Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid (CVSS 5.3)
• CVE-2026-114398 — Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo (CVSS 5.4)
• CVE-2026-114393 — Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints (CVSS 4.3)
• CVE-2026-111345 — Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id (CVSS 4.3)
• CVE-2021-45785 — (CVSS 6.5)
• CVE-2023-26982 — (CVSS 5.4)
• CVE-2022-1719 — Reflected XSS on ticket filter function in polonel/trudesk (CVSS 5.4)
• CVE-2022-1718 — The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk (CVSS 7.5)
• CVE-2022-2128 — Unrestricted Upload of File with Dangerous Type in polonel/trudesk (CVSS 9.8)
• CVE-2022-2023 — Incorrect Use of Privileged APIs in polonel/trudesk (CVSS 9.8)
• CVE-2022-1947 — Use of Incorrect Operator in polonel/trudesk (CVSS 6.5)
• CVE-2022-1893 — Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk (CVSS 5.3)
• CVE-2022-1808 — Execution with Unnecessary Privileges in polonel/trudesk (CVSS 8.8)
• CVE-2022-1926 — Integer Overflow or Wraparound in polonel/trudesk (CVSS 4.9)
• CVE-2022-1931 — Incorrect Synchronization in polonel/trudesk (CVSS 8.1)
• CVE-2022-1752 — Unrestricted Upload of File with Dangerous Type in polonel/trudesk (CVSS 8.0)
• CVE-2022-1775 — Weak Password Requirements in polonel/trudesk (CVSS 9.8)