agentprime: freescout

agentprime: freescoutEvery new CVE for freescout.https://agentprime.io/CVE-2026-107393: FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Headerhttps://agentprime.io/advisories/CVE-2026-107393/https://agentprime.io/advisories/CVE-2026-107393/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 19:52:23 GMTCVECVE-2026-53596: FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)https://agentprime.io/advisories/CVE-2026-53596/https://agentprime.io/advisories/CVE-2026-53596/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 20:17:38 GMTCVECVE-2026-53595: FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLhttps://agentprime.io/advisories/CVE-2026-53595/https://agentprime.io/advisories/CVE-2026-53595/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 20:14:59 GMTCVEcriticalCVE-2026-53594: FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Pathhttps://agentprime.io/advisories/CVE-2026-53594/https://agentprime.io/advisories/CVE-2026-53594/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 20:12:54 GMTCVECVE-2026-53593: FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471https://agentprime.io/advisories/CVE-2026-53593/https://agentprime.io/advisories/CVE-2026-53593/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 19:52:33 GMTCVECVE-2026-53592: FreeScout vulnerable to prototype pollution in getQueryParamhttps://agentprime.io/advisories/CVE-2026-53592/https://agentprime.io/advisories/CVE-2026-53592/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 19:49:06 GMTCVECVE-2026-53591: FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmailshttps://agentprime.io/advisories/CVE-2026-53591/https://agentprime.io/advisories/CVE-2026-53591/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 19:47:18 GMTCVECVE-2026-48812: FreeScout Allows Unauthenticated Access to Legacy Attachment Fileshttps://agentprime.io/advisories/CVE-2026-48812/https://agentprime.io/advisories/CVE-2026-48812/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 17:32:46 GMTCVECVE-2026-45295: FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpointhttps://agentprime.io/advisories/CVE-2026-45295/https://agentprime.io/advisories/CVE-2026-45295/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 17:21:49 GMTCVECVE-2026-45294: FreeScout: User Account Enumeration via Password Reset Response Differentiationhttps://agentprime.io/advisories/CVE-2026-45294/https://agentprime.io/advisories/CVE-2026-45294/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 19:52:22 GMTCVECVE-2026-47123: FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Pathhttps://agentprime.io/advisories/CVE-2026-47123/https://agentprime.io/advisories/CVE-2026-47123/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 19:51:41 GMTCVECVE-2026-48810: FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Checkhttps://agentprime.io/advisories/CVE-2026-48810/https://agentprime.io/advisories/CVE-2026-48810/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 19:48:38 GMTCVECVE-2026-48811: FreeScout: Thread Deletion Bypasses Mailbox Access Revocationhttps://agentprime.io/advisories/CVE-2026-48811/https://agentprime.io/advisories/CVE-2026-48811/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 19:47:46 GMTCVECVE-2026-41906: FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypasshttps://agentprime.io/advisories/CVE-2026-41906/https://agentprime.io/advisories/CVE-2026-41906/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 18:09:23 GMTCVECVE-2026-41905: FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata accesshttps://agentprime.io/advisories/CVE-2026-41905/https://agentprime.io/advisories/CVE-2026-41905/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 18:08:09 GMTCVECVE-2026-41904: FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip_tags validator with mixed text+HTML contenthttps://agentprime.io/advisories/CVE-2026-41904/https://agentprime.io/advisories/CVE-2026-41904/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 18:05:43 GMTCVECVE-2026-41902: FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leakshttps://agentprime.io/advisories/CVE-2026-41902/https://agentprime.io/advisories/CVE-2026-41902/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 18:03:50 GMTCVEcriticalCVE-2026-41903: FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472)https://agentprime.io/advisories/CVE-2026-41903/https://agentprime.io/advisories/CVE-2026-41903/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 18:02:01 GMTCVECVE-2026-41194: FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFablehttps://agentprime.io/advisories/CVE-2026-41194/https://agentprime.io/advisories/CVE-2026-41194/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 17:16:50 GMTCVECVE-2026-41193: FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCEhttps://agentprime.io/advisories/CVE-2026-41193/https://agentprime.io/advisories/CVE-2026-41193/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 17:15:26 GMTCVEcriticalCVE-2026-41192: FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachmentshttps://agentprime.io/advisories/CVE-2026-41192/https://agentprime.io/advisories/CVE-2026-41192/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 17:12:42 GMTCVECVE-2026-41191: FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changeshttps://agentprime.io/advisories/CVE-2026-41191/https://agentprime.io/advisories/CVE-2026-41191/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 17:09:26 GMTCVECVE-2026-41190: FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injectionhttps://agentprime.io/advisories/CVE-2026-41190/https://agentprime.io/advisories/CVE-2026-41190/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 17:06:31 GMTCVECVE-2026-41189: FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threadshttps://agentprime.io/advisories/CVE-2026-41189/https://agentprime.io/advisories/CVE-2026-41189/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 17:04:07 GMTCVECVE-2026-41183: FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversationshttps://agentprime.io/advisories/CVE-2026-41183/https://agentprime.io/advisories/CVE-2026-41183/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 17:00:39 GMTCVECVE-2026-40592: FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound replyhttps://agentprime.io/advisories/CVE-2026-40592/https://agentprime.io/advisories/CVE-2026-40592/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:57:33 GMTCVECVE-2026-40591: FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modificationhttps://agentprime.io/advisories/CVE-2026-40591/https://agentprime.io/advisories/CVE-2026-40591/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:54:14 GMTCVECVE-2026-40590: FreeScout's Customer AJAX Create Modifies Hidden Existing Customerhttps://agentprime.io/advisories/CVE-2026-40590/https://agentprime.io/advisories/CVE-2026-40590/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:52:27 GMTCVECVE-2026-40589: FreeScout has Customer Edit Cross-Mailbox Email Takeoverhttps://agentprime.io/advisories/CVE-2026-40589/https://agentprime.io/advisories/CVE-2026-40589/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:50:22 GMTCVECVE-2026-40570: FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PIIhttps://agentprime.io/advisories/CVE-2026-40570/https://agentprime.io/advisories/CVE-2026-40570/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:48:08 GMTCVECVE-2026-40569: FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltrationhttps://agentprime.io/advisories/CVE-2026-40569/https://agentprime.io/advisories/CVE-2026-40569/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:46:15 GMTCVEcriticalCVE-2026-40568: FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitizationhttps://agentprime.io/advisories/CVE-2026-40568/https://agentprime.io/advisories/CVE-2026-40568/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:08:37 GMTCVECVE-2026-40567: FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variableshttps://agentprime.io/advisories/CVE-2026-40567/https://agentprime.io/advisories/CVE-2026-40567/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:06:39 GMTCVECVE-2026-40566: FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpointshttps://agentprime.io/advisories/CVE-2026-40566/https://agentprime.io/advisories/CVE-2026-40566/CVSS 4.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 16:04:35 GMTCVECVE-2026-40565: FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor hrefhttps://agentprime.io/advisories/CVE-2026-40565/https://agentprime.io/advisories/CVE-2026-40565/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 15:52:39 GMTCVECVE-2026-40498: FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cronhttps://agentprime.io/advisories/CVE-2026-40498/https://agentprime.io/advisories/CVE-2026-40498/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 15:01:20 GMTCVECVE-2026-40497: FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)https://agentprime.io/advisories/CVE-2026-40497/https://agentprime.io/advisories/CVE-2026-40497/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 01:45:55 GMTCVECVE-2026-40496: FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Forcehttps://agentprime.io/advisories/CVE-2026-40496/https://agentprime.io/advisories/CVE-2026-40496/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 01:38:50 GMTCVECVE-2026-35584: FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumerationhttps://agentprime.io/advisories/CVE-2026-35584/https://agentprime.io/advisories/CVE-2026-35584/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 16:07:33 GMTCVECVE-2026-39384: FreeScout Customer Merge Cross-Mailbox Authorization Bypasshttps://agentprime.io/advisories/CVE-2026-39384/https://agentprime.io/advisories/CVE-2026-39384/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 16:05:16 GMTCVECVE-2026-34442: FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScouthttps://agentprime.io/advisories/CVE-2026-34442/https://agentprime.io/advisories/CVE-2026-34442/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 31 Mar 2026 21:28:19 GMTCVECVE-2026-34443: FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()https://agentprime.io/advisories/CVE-2026-34443/https://agentprime.io/advisories/CVE-2026-34443/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 31 Mar 2026 21:28:16 GMTCVECVE-2026-32754: FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})https://agentprime.io/advisories/CVE-2026-32754/https://agentprime.io/advisories/CVE-2026-32754/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 21:35:17 GMTCVEcriticalCVE-2026-32753: FreeScout: Stored XSS through SVG file upload with filter bypasshttps://agentprime.io/advisories/CVE-2026-32753/https://agentprime.io/advisories/CVE-2026-32753/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 21:26:09 GMTCVECVE-2026-32752: FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messageshttps://agentprime.io/advisories/CVE-2026-32752/https://agentprime.io/advisories/CVE-2026-32752/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 21:21:54 GMTCVECVE-2026-28289: FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-28289/https://agentprime.io/advisories/CVE-2026-28289/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.35 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Mar 2026 22:59:08 GMTCVEcriticalCVE-2026-27636: FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apachehttps://agentprime.io/advisories/CVE-2026-27636/https://agentprime.io/advisories/CVE-2026-27636/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Feb 2026 03:41:33 GMTCVECVE-2026-27637: FreeScout's Predictable Authentication Token Enables Account Takeoverhttps://agentprime.io/advisories/CVE-2026-27637/https://agentprime.io/advisories/CVE-2026-27637/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Feb 2026 03:41:23 GMTCVEcriticalCVE-2025-58163: FreeScout's deserialization of untrusted data can lead to Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-58163/https://agentprime.io/advisories/CVE-2025-58163/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 03 Sep 2025 01:34:16 GMTCVECVE-2025-54366: FreeScout's deserialization of untrusted data leads to Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-54366/https://agentprime.io/advisories/CVE-2025-54366/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Jul 2025 03:35:17 GMTCVE