What is the CVSS score of CVE-2026-24959?

CVE-2026-24959 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of JoomSky JS Help Desk are affected by CVE-2026-24959?

A critical SQL injection vulnerability in JS Help Desk (versions ≤ 3.0.1) allows attackers to extract sensitive data from your support ticketing system without detection.

How to fix or mitigate CVE-2026-24959?

Within 24 hours: Audit all systems running JS Help Desk ≤ 3.0.1 and assess exposure; notify your support team of potential compromise. Within 7 days: Implement Web Application Firewall (WAF) rules blocking SQL injection patterns, restrict database user permissions, and disable the plugin if non-critical. Within 30 days: Plan migration to an alternative support ticketing solution or await vendor patch; conduct forensic audit for unauthorized database access.

JoomSky JS Help Desk CVE-2026-24959

HIGH

SQL Injection (CWE-89)

2026-02-20 audit@patchstack.com

SQLi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 16:22 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.

AnalysisAI

Blind SQL injection in JoomSky JS Help Desk through version 3.0.1 enables authenticated attackers to execute arbitrary SQL queries with network access and no user interaction required. The vulnerability affects database confidentiality and system availability, though integrity is not compromised. No patch is currently available for this high-severity flaw.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects JoomSky JS Help Desk js-support-ticket. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.

Affected ProductsAI

Product: JoomSky JS Help Desk js-support-ticket.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.