Advisories · Technology

polonel trudesk.

Every CVE that names polonel trudesk among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-114402 CVE record

CVSS 5.3 Medium

Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
- polonel trudesk
- Path traversal
Not analysed yet 21 Oct 2026
CVE-2026-114401 CVE record

CVSS 6.9 Medium

Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
- polonel trudesk
- Other injection
Not analysed yet 21 Oct 2026
CVE-2026-114400 CVE record

CVSS 8.2 High

Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
- polonel trudesk
- Information disclosure
Not analysed yet 21 Oct 2026
CVE-2026-114399 CVE record

CVSS 7.0 High

Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
- polonel trudesk
- Path traversal
Not analysed yet 21 Oct 2026
CVE-2026-114398 CVE record

CVSS 5.1 Medium

Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
- polonel trudesk
- Unrestricted file upload
Not analysed yet 21 Oct 2026
CVE-2026-114397 CVE record

CVSS 8.3 High

Trudesk through 1.2.11 Missing Authentication on Debug Routes
- polonel trudesk
- CWE-1188
Not analysed yet 21 Oct 2026
CVE-2026-114396 CVE record

CVSS 7.1 High

Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
- polonel trudesk
- Other injection
Not analysed yet 21 Oct 2026
CVE-2026-114395 CVE record

CVSS 5.3 Medium

Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
- polonel trudesk
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-114394 CVE record

CVSS 5.3 Medium

Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
- polonel trudesk
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-114393 CVE record

CVSS 5.3 Medium

Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
- polonel trudesk
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-114392 CVE record

CVSS 6.9 Medium

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
- polonel trudesk
- Broken access control
Not analysed yet 21 Oct 2026
CVE-2026-111345 CVE record

CVSS 5.3 Medium

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id
- polonel trudesk
- Broken access control
Not analysed yet 15 Oct 2026
CVE-2022-2128 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Unrestricted Upload of File with Dangerous Type in polonel/trudesk
- polonel/trudesk
- Unrestricted file upload
Not analysed yet 20 Jun 2022
CVE-2022-2023 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Incorrect Use of Privileged APIs in polonel/trudesk
- polonel/trudesk
- CWE-648
Not analysed yet 20 Jun 2022
CVE-2022-1947 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Use of Incorrect Operator in polonel/trudesk
- polonel/trudesk
- CWE-480
Not analysed yet 31 May 2022
CVE-2022-1808 CVE record

CVSS 8.8 High

Execution with Unnecessary Privileges in polonel/trudesk
- polonel/trudesk
- Privilege escalation
Not analysed yet 31 May 2022
CVE-2022-1893 CVE record

CVSS 4.6 Medium

Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk
- polonel/trudesk
- CWE-212
Not analysed yet 31 May 2022
CVE-2022-1926 CVE record

CVSS 7.6 High

Integer Overflow or Wraparound in polonel/trudesk
- polonel/trudesk
- Memory corruption
Not analysed yet 31 May 2022
CVE-2022-1931 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect Synchronization in polonel/trudesk
- polonel/trudesk
- CWE-821
Not analysed yet 31 May 2022
CVE-2022-1752 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Unrestricted Upload of File with Dangerous Type in polonel/trudesk
- polonel/trudesk
- Unrestricted file upload
Not analysed yet 21 May 2022
CVE-2022-1775 CVE record

CVSS 8.4 High

Weak Password Requirements in polonel/trudesk
- polonel/trudesk
- Hard-coded credentials
Not analysed yet 20 May 2022
CVE-2022-1803 CVE record

CVSS 8.4 High

Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk
- polonel/trudesk
- CWE-1021
Not analysed yet 20 May 2022
CVE-2022-1770 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Improper Privilege Management in polonel/trudesk
- polonel/trudesk
- Privilege escalation
Not analysed yet 20 May 2022
CVE-2022-1754 CVE record

CVSS 8.4 High

Integer Overflow or Wraparound in polonel/trudesk
- polonel/trudesk
- Memory corruption
Not analysed yet 20 May 2022
CVE-2022-1728 CVE record

CVSS 7.6 High

Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk
- polonel/trudesk
- Memory corruption
Not analysed yet 16 May 2022
CVE-2022-1718 CVE record

CVSS 7.2 High

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in…
- polonel/trudesk
- Memory corruption
Not analysed yet 16 May 2022
CVE-2022-1719 CVE record

CVSS 5.5 Medium

Reflected XSS on ticket filter function in polonel/trudesk
- polonel/trudesk
- Cross-site scripting (XSS)
Not analysed yet 16 May 2022
CVE-2022-1044 CVE record

CVSS 8.2 High

Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk
- polonel/trudesk
- Information disclosure
Not analysed yet 12 May 2022
CVE-2022-1045 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Stored XSS viva .svg file upload in polonel/trudesk
- polonel/trudesk
- Unrestricted file upload
Not analysed yet 11 Apr 2022
CVE-2022-1290 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk
- polonel/trudesk
- Cross-site scripting (XSS)
Not analysed yet 10 Apr 2022