freescout-help-desk

4 results · Clear filters · Feed

• Critical 9.4
  CVE-2026-53595 Public exploit Scanner template

  FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

  FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash`…

  freescout-help-desk freescout
  Jul 20, 2026
• Medium 6.9
  CVE-2026-35584 Public exploit

  FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration

  FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the g…

  freescout-help-desk freescout
  Apr 7, 2026
• Critical 10.0
  CVE-2026-28289 Public exploit EPSS 35%

  FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution

  FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RC…

  freescout-help-desk freescout
  Mar 3, 2026
• High 8.8
  CVE-2026-27636 Public exploit

  FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache

  FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's file upload restriction list in `app/Misc/Helper.php` does not include `.htaccess` or `.user.ini` files. On Apache servers with `AllowOver…

  freescout-help-desk freescout
  Feb 25, 2026