Approved changes feed: RSS · Atom
cpe:2.3:a:polonel:trudesk:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Polonel (701b5251-3f1a-5189-b223-db16c0750dda) |
|---|---|
| Product | Trudesk (6f7e7e42-cb53-5c09-82c2-1a2da9b2090e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114401 |
vulnerable | 2026-11-03 10:15:54.014917 |
Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
MEDIUM (5.3)
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.
Published: 2026-10-21T12:39:54.187Z
Updated: 2026-10-21T19:57:13.714Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114395 |
vulnerable | 2026-11-03 10:15:54.000860 |
Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
MEDIUM (4.3)
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.
Published: 2026-10-21T12:39:50.133Z
Updated: 2026-10-21T13:24:57.765Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114399 |
vulnerable | 2026-11-03 10:15:53.751276 |
Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
MEDIUM (6.5)
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
Published: 2026-10-21T12:39:52.827Z
Updated: 2026-10-21T15:48:28.516Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114398 |
vulnerable | 2026-11-03 10:15:53.635207 |
Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
MEDIUM (5.4)
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
Published: 2026-10-21T12:39:52.147Z
Updated: 2026-10-28T16:27:59.714Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114394 |
vulnerable | 2026-11-03 10:15:53.620519 |
Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
MEDIUM (4.3)
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.
Published: 2026-10-21T12:39:49.408Z
Updated: 2026-10-21T15:48:35.664Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114400 |
vulnerable | 2026-11-03 10:15:53.612089 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114402 |
vulnerable | 2026-11-03 10:15:53.253523 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114392 |
vulnerable | 2026-11-03 10:15:53.145613 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114397 |
vulnerable | 2026-11-03 10:15:53.097068 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114393 |
vulnerable | 2026-11-03 10:15:53.006253 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.