repository icon
polonel / trudesk Project repository

:coffee: :seedling: Trudesk is an open-source help desk/ticketing solution.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN73 DAYS

FIX

WITHIN56 DAYS

Self XSS in Ticket
rezaduty
pending
XSS in Ticket Tags
rezaduty
pending
XSS in Site Legal Setting Privacy Policy
rezaduty
pending
Path Traversal leads to Delete all system files
thanhlocstudent
pending
Multiple bypass Restricted Upload File to perform Stored XSS
thanhlocstudent
pending
Multiple Broken Access Controls lead to Website Defacement
thanhlocstudent
pending
Insecure Direct Object Reference leads to change all User Information
thanhlocstudent
pending
Stored Cross-Site Scripting (XSS) at Set Site Title
oldboysonnt
pending
Stored Cross-Site Scripting (XSS) at Upload Image Function
oldboysonnt
pending
Incorrect use of privileged APIs to steal victim's account
lengochoa7112000
Critical
•$12•CVE-2022-2023
Unrestricted Upload of File with any dangerous extension
lengochoa7112000
Critical
•$12•CVE-2022-2128
HTML Injection in message
lengochoa7112000
not applicable
Cross-site Scripting (XSS) - Stored
kevin-mizu
duplicate
Medium
Incorrect Behavior Make Crash and Can not Access Account
lengochoa7112000
Critical
•$10•CVE-2022-1947
Send messenger to another user with any sender account
lengochoa7112000
Critical
•$10•CVE-2022-1931
cross-site scripting (XSS) generic
lengochoa7112000
duplicate
High
Cross-site Scripting (XSS) - Stored
lengochoa7112000
not applicable
Meta Data Is Not Stripped From images
akshayravic09yc47
Medium
•CVE-2022-1893
Stored XSS in message conversations
domiee13
duplicate
High
Allocation of Resources Without Limits in
akshayravic09yc47
High
•$5•CVE-2022-1926
Cross-Site Request Forgery (CSRF)
khanhchauminh
duplicate
High
Cross-site Scripting (XSS) - Stored in Name field of User Profile
khanhchauminh
duplicate
Critical
Cross-site Scripting (XSS) - Stored
khanhchauminh
duplicate
Critical
UI REDRESSING
vishalvishw10
High
•$5•CVE-2022-1803
No BruteForce Protection
vishalvishw10
duplicate
High
Stored XSS in accounts/customers
vishalvishw10
duplicate
High
SESSION DOESNT EXPIRE AFTER PASSWORD CHANGE
vishalvishw10
duplicate
High
Weak Password Policy
vishalvishw10
High
•$5•CVE-2022-1775
Improper Neutralization of HTML tag's in the "Comment" box leads to open redirec...
sampritdas8
duplicate
Critical
HTML Injection in Ticket
vishalvishw10
duplicate
High
The trudesk application allows large characters to insert in the input field "Te...
vishalvishw10
duplicate
High
The trudesk application allows large characters to insert in the input field "Na...
vishalvishw10
High
•$5•CVE-2022-1754
Insufficient Session Expiration
sampritdas8
Critical
•$10
Cross-site Scripting (XSS) - Stored in polonel/trudesk
vishalvishw10
duplicate
Critical
Stored XSS via messaging functionality
nithissh200
duplicate
High
Allowing long password leads to denial of service in polonel/trudesk
vishalvishw10
High
•$5•CVE-2022-1728
Cross-site Scripting (XSS) - Reflected
tharunavula
duplicate
High
The trudesk application allows large characters to insert in the input field "Fu...
akshayravic09yc47
High
•CVE-2022-1718
Improper Privilege Management API V2
tienpa99
Critical
•CVE-2022-1770
Unrestricted File Upload and Path Traversal in upload image
tienpa99
Critical
•CVE-2022-1752
Register users in spite of Allow User Registration disabled
tienpa99
High
Stored HTML Injection via Ticket Messages on the https://docker.trudesk.io/messa...
thewhiteevil
informative
Medium
Reflected XSS on ticket filter function
baharuddinzulkifli
Medium
•CVE-2022-1719
Stored XSS via Messages on the https://docker.trudesk.io/messages/6273570c2e35a3...
thewhiteevil
duplicate
High
Stored XSS via Ticket File Upload part on the https://docker.trudesk.io/
thewhiteevil
duplicate
High
Stored XSS
baharuddinzulkifli
duplicate
Medium
XSS at chatbox
minhnb11
duplicate
High
Stored XSS in "Title"
sampritdas8
duplicate
Critical
Stored XSS in "Group Name"
sampritdas8
duplicate
Critical
Stored XSS in "Name", "Group Name" & "Title"
sampritdas8
Critical
•CVE-2022-1290
Sensitive Data Exposure Due To Insecure Storage Of Profile Image
sampritdas8
High
•CVE-2022-1044
Stored XSS viva .svg file upload
sampritdas8
Critical
•CVE-2022-1045
Exposure of Sensitive Information to an Unauthorized Actor
1d8
High
Generation of Error Message Containing Sensitive Information
1d8
Medium
Cross-Site Request Forgery (CSRF)
1d8
Medium
Cross-site Scripting (XSS) - Stored
1d8
High
Improper Restriction of Excessive Authentication Attempts
sudheendra17
Medium
Cross-site Scripting (XSS) - Stored
govindpalakkal
duplicate
High
Cross-site Scripting (XSS) - Stored
govindpalakkal
duplicate
High
Unrestricted Upload of File with Dangerous Type
effectrenan
High
•$25
Cross-site Scripting (XSS) - Stored
effectrenan
High
•$25
Cross-site Scripting (XSS) - Stored
effectrenan
not applicable
Cross-site Scripting (XSS) - Stored
effectrenan
not applicable
Cross-site Scripting (XSS) - Stored
nedondev
not applicable
Cross-site Scripting (XSS) - Stored
nedondev
not applicable
Improper Privilege Management
ranjit-git
High
•$25
Least Privilege Violation
ranjit-git
High
•$25
Execution with Unnecessary Privileges
ranjit-git
High
•$25•CVE-2022-1808
Improper Handling of Insufficient Privileges
ranjit-git
informative
High
Improper Privilege Management
ranjit-git
not applicable
Improper Privilege Management
ranjit-git
not applicable
Execution with Unnecessary Privileges
ranjit-git
not applicable
Cross-site Scripting (XSS) - Stored
ranjit-git
High
•$25
Improper Privilege Management
ranjit-git
not applicable
Cross-site Scripting (XSS) - Stored
ranjit-git
Critical
•$25
Cross-site Scripting (XSS) - Stored
ranjit-git
Critical
•$25