Community Skeleton
Approved changes feed: RSS · Atom
cpe:2.3:a:uvdesk:community-skeleton:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Uvdesk (4b6b10f2-df87-5e03-966d-44d93b5e951e) |
|---|---|
| Product | Community Skeleton (2f86d59c-676b-5a48-a5f1-fd9119a81598) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/uvdesk/community-skeleton |
purl2cpe | 2026-06-01 10:12:25.475282 |
pkg:github/uvdesk/community-skeleton |
purl2cpe | 2026-06-01 10:12:25.475285 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-92805 |
vulnerable | 2026-10-13 12:28:53.822771 |
UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
CRITICAL (9.8)
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.
Published: 2026-09-16T20:32:54.622Z
Updated: 2026-09-19T01:52:49.216Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-71419 |
vulnerable | 2026-10-13 12:22:43.746560 |
UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer
MEDIUM (5.4)
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
Published: 2026-09-21T13:43:33.353Z
Updated: 2026-10-06T13:36:45.739Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-71420 |
vulnerable | 2026-10-13 12:22:43.680093 |
UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply
MEDIUM (4.3)
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
Published: 2026-09-21T13:43:34.312Z
Updated: 2026-10-06T13:36:46.572Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-71421 |
vulnerable | 2026-10-13 12:22:43.601932 |
UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent
HIGH (7.2)
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
Published: 2026-09-21T13:43:35.237Z
Updated: 2026-10-06T13:36:47.475Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3137 |
vulnerable | 2026-06-08 06:41:52.553898 |
Improper Privilege Management in uvdesk/community-skeleton
HIGH (7.1)
Improper Privilege Management in uvdesk/community-skeleton
Published: 2024-04-02T00:00:14.584Z
Updated: 2024-09-06T16:21:28.198Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1197 |
vulnerable | 2026-06-08 05:52:34.086774 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.