Advisories · Technology
rabilal JS Help Desk – AI-Powered Support & Ticketing System.
Every CVE that names rabilal JS Help Desk – AI-Powered Support & Ticketing System among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.9 Medium
JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
- rabilal JS Help Desk – AI-Powered Support & Ticketing System
- Path traversal
- CVSS 7.5 High
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter
- rabilal JS Help Desk – AI-Powered Support & Ticketing System
- SQL injection
- CVSS 7.5 High
JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie
- rabilal JS Help Desk – AI-Powered Support & Ticketing System
- SQL injection
- CVSS 7.5 High
JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
- rabilal JS Help Desk – AI-Powered Support & Ticketing System
- Information disclosure
- CVSS 4.3 Medium
JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
- rabilal JS Help Desk – AI-Powered Support & Ticketing System
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution
- rabilal JS Help Desk – AI-Powered Support & Ticketing System
- Code injection