Most severe vulnerabilities for "frappe helpdesk"

Where

Sort:

Versions

1.14.0

Frappe Frappe HelpDeskFrappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_data

Risk 79

Severity

8.6

SQL Injection

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SQL Injection in Frappe HelpDesk in the dashboard getdashboarddata due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This issue affects Frappe HelpDesk: 1.14.0.

First published (updated )

CVE-2025-10655

Frappe HelpDeskFrappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

Risk 32

Severity

5.1

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raisedby value. Attackers can call the hdticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via getticketactivities.

First published (updated )

CVE-2026-111939

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.