Threats affecting pkg:github/friends-of-presta/helpdesk

3 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.1	EPSS 0.2%	CVE-2026-111939frappe helpdesk · Insecure Direct Object Reference Medium5.1EPSS 0.2%2026-10-19CVE Database V5CVE-2026-111939 Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities. EPSS 0.2%Vulnerability	CVE Database V5	2026-10-19
High	8.6	EPSS 0.6%	CVE-2025-10655Frappe HelpDesk · SQL Injection High8.6EPSS 0.6%2025-12-09CVE Database V5CVE-2025-10655 SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0. EPSS 0.6%Vulnerability CWE-89	CVE Database V5	2025-12-09
Critical	10.0	EPSS 0.5%	CVE-2024-34990helpdesk · Unrestricted File Upload Critical10.0EPSS 0.5%2024-06-19CVE Database V5CVE-2024-34990 In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontController::replyTicket()` allow upload of .php files on a predictable path for connected customers. EPSS 0.5%Vulnerability CWE-434	CVE Database V5	2024-06-19

Page 1 of 1