Faveo Helpdesk
Monthly
Broken access control in Faveo Helpdesk 2.0.3's v1 REST API exposes all ticket conversations to any self-registered customer. The endpoint validates that a requested ticket exists but performs no ownership check, so any authenticated customer can enumerate and read tickets belonging to other customers - including internal agent notes that may contain sensitive operational or personal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier (valid account only) makes this a practical risk in any multi-tenant deployment.
An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
public/rolechangeadmin in Faveo 1.9.3 allows CSRF. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken access control in Faveo Helpdesk 2.0.3's v1 REST API exposes all ticket conversations to any self-registered customer. The endpoint validates that a requested ticket exists but performs no ownership check, so any authenticated customer can enumerate and read tickets belonging to other customers - including internal agent notes that may contain sensitive operational or personal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier (valid account only) makes this a practical risk in any multi-tenant deployment.
An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Faveo Helpdesk Enterprise version 6.0.1 allows an attacker with agent permissions to perform privilege escalation on the application. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
public/rolechangeadmin in Faveo 1.9.3 allows CSRF. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.