Js Help Desk
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:js_help_desk:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Js Help Desk (d11f437a-c313-52ee-9396-ae11348a73dc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14929 |
vulnerable | 2026-09-16 04:33:12.502260 |
JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.
Published: 2026-07-31T06:00:08.669Z
Updated: 2026-07-31T13:24:23.485Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14931 |
vulnerable | 2026-09-16 04:33:12.489600 |
JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
Published: 2026-07-31T06:00:09.023Z
Updated: 2026-07-31T19:47:50.635Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14928 |
vulnerable | 2026-09-16 04:33:12.125978 |
JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
Published: 2026-07-31T06:00:08.494Z
Updated: 2026-07-31T19:42:49.082Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14930 |
vulnerable | 2026-09-16 04:33:12.116960 |
JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.
Published: 2026-07-31T06:00:08.845Z
Updated: 2026-07-31T19:46:54.676Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15209 |
vulnerable | 2026-09-16 04:33:06.794606 |
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
Published: 2026-07-31T06:00:09.640Z
Updated: 2026-07-31T19:45:10.724Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.