Core Framework
Approved changes feed: RSS · Atom
cpe:2.3:a:uvdesk:core-framework:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Uvdesk (4b6b10f2-df87-5e03-966d-44d93b5e951e) |
|---|---|
| Product | Core Framework (7c7fa62c-9da1-5724-b9d8-23ecea38788d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-71419 |
vulnerable | 2026-10-13 12:22:43.745934 |
UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer
MEDIUM (5.4)
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
Published: 2026-09-21T13:43:33.353Z
Updated: 2026-10-06T13:36:45.739Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-71420 |
vulnerable | 2026-10-13 12:22:43.679444 |
UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply
MEDIUM (4.3)
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.
Published: 2026-09-21T13:43:34.312Z
Updated: 2026-10-06T13:36:46.572Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-71421 |
vulnerable | 2026-10-13 12:22:43.600888 |
UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent
HIGH (7.2)
UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.
Published: 2026-09-21T13:43:35.237Z
Updated: 2026-10-06T13:36:47.475Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.