Skip to content
OpenAdvisories

Product · polonel

trudesk

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-114397

    Trudesk through 1.2.11 Missing Authentication on Debug Routes

    Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, the…

    polonel trudesk
  • High 7.1
    CVE-2026-114396

    Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

    Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to …

    polonel trudesk