Faveo
Monthly
Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbitrary files on the server by manipulating the `data1` argument passed to PHP's `unlink()` function within the Logo Handler component (`SettingsController.php`). Exploitation is limited to accounts holding high privileges, constraining realistic impact despite network reachability. Publicly available exploit code exists via a GitHub issue report; the vendor has not responded to the disclosure as of time of analysis.
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted requests to the post-ticket-reply endpoint without valid session credentials. The flaw exists in FormController::post_ticket_reply (CWE-306), allowing manipulation of helpdesk communications and injection of fraudulent responses into active support tickets. A proof-of-concept exploit has been publicly published via a GitHub issue, though no vendor patch is available as the maintainers have not yet responded to the disclosure.
Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"]. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbitrary files on the server by manipulating the `data1` argument passed to PHP's `unlink()` function within the Logo Handler component (`SettingsController.php`). Exploitation is limited to accounts holding high privileges, constraining realistic impact despite network reachability. Publicly available exploit code exists via a GitHub issue report; the vendor has not responded to the disclosure as of time of analysis.
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted requests to the post-ticket-reply endpoint without valid session credentials. The flaw exists in FormController::post_ticket_reply (CWE-306), allowing manipulation of helpdesk communications and injection of fraudulent responses into active support tickets. A proof-of-concept exploit has been publicly published via a GitHub issue, though no vendor patch is available as the maintainers have not yet responded to the disclosure.
Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"]. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.