Freescout vulnerabilities

Products

• Freescout 46

Newest

• freescout FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href CVE-2026-40565 6.1 MediumApril 21, 2026
• freescout FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVE-2026-40498 8.9 HighApril 21, 2026
• freescout FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration) CVE-2026-40497 8.1 HighApril 21, 2026
• freescout FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVE-2026-40496 8.8 HighApril 21, 2026
• freescout FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration CVE-2026-35584 Public exploit 6.9 MediumApril 7, 2026
• freescout FreeScout Customer Merge Cross-Mailbox Authorization Bypass CVE-2026-39384 7.6 HighApril 7, 2026
• freescout FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout CVE-2026-34442 5.4 MediumMarch 31, 2026
• freescout FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask() CVE-2026-34443 6.9 MediumMarch 31, 2026
• freescout FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) CVE-2026-32754 9.3 CriticalMarch 19, 2026
• freescout FreeScout: Stored XSS through SVG file upload with filter bypass CVE-2026-32753 8.5 HighMarch 19, 2026
• freescout FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages CVE-2026-32752 0.0 NoneMarch 19, 2026
• freescout FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution CVE-2026-28289 Public exploit EPSS 35.1% 10.0 CriticalMarch 3, 2026
• freescout FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache CVE-2026-27636 Public exploit 8.8 HighFebruary 25, 2026
• freescout FreeScout's Predictable Authentication Token Enables Account Takeover CVE-2026-27637 9.8 CriticalFebruary 25, 2026
• freescout FreeScout's deserialization of untrusted data can lead to Remote Code Execution CVE-2025-58163 8.6 HighSeptember 3, 2025
• freescout FreeScout's deserialization of untrusted data leads to Remote Code Execution CVE-2025-54366 8.6 HighJuly 26, 2025
• freescout FreeScout Vulnerable to Stored XSS CVE-2025-48488 4.6 MediumMay 30, 2025
• freescout FreeScout has Race Condition When Deleting Users CVE-2025-48880 5.1 MediumMay 30, 2025
• freescout FreeScout Vulnerable to Stored XSS CVE-2025-48875 4.6 MediumMay 30, 2025
• freescout FreeScout Vulnerable to Stored XSS CVE-2025-48489 4.6 MediumMay 30, 2025
• freescout FreeScout Vulnerable to Stored XSS CVE-2025-48487 6.0 MediumMay 30, 2025
• freescout FreeScout Vulnerable to Stored XSS CVE-2025-48486 6.1 MediumMay 30, 2025
• freescout FreeScout Vulnerable to Stored XSS CVE-2025-48485 6.1 MediumMay 30, 2025
• freescout FreeScout Vulnerable to Stored XSS CVE-2025-48484 4.6 MediumMay 30, 2025
• freescout FreeScout Stored XSS leads to CSRF CVE-2025-48483 6.3 MediumMay 30, 2025
• freescout FreeScout Has Business Logic Errors CVE-2025-48482 5.3 MediumMay 30, 2025
• freescout FreeScout Has Business Logic Errors CVE-2025-48481 6.1 MediumMay 30, 2025
• freescout FreeScout Has Business Logic Errors CVE-2025-48480 7.0 HighMay 30, 2025
• freescout FreeScout Has Business Logic Errors CVE-2025-48479 8.5 HighMay 30, 2025
• freescout FreeScout Has Business Logic Errors CVE-2025-48478 7.0 HighMay 30, 2025
• freescout FreeScout Has Business Logic Errors CVE-2025-48477 7.1 HighMay 30, 2025
• freescout FreeScout Has Business Logic Errors CVE-2025-48476 7.1 HighMay 30, 2025
• freescout FreeScout Vulnerable to Insufficient Authorization CVE-2025-48475 5.3 MediumMay 29, 2025
• freescout FreeScout Vulnerable to Insufficient Authorization CVE-2025-48474 5.3 MediumMay 29, 2025
• freescout FreeScout Vulnerable to Insufficient Authorization CVE-2025-48473 5.3 MediumMay 29, 2025
• freescout FreeScout Vulnerable to Insufficient Authorization CVE-2025-48472 6.9 MediumMay 29, 2025
• freescout FreeScout Vulnerable to Arbitrary File Upload CVE-2025-48471 7.0 HighMay 29, 2025
• freescout FreeScout Vulnerable to Remote Code Execution (RCE) CVE-2025-48390 8.6 HighMay 29, 2025
• freescout FreeScout Vulnerable to Deserialization of Untrusted Data CVE-2025-48389 8.6 HighMay 29, 2025
• freescout FreeScout Has Insufficient Protection Against CRLF-injection CVE-2025-48388 7.0 HighMay 29, 2025
• freescout Prototype Pollution in getQueryParam Function (URL Query Parser) CVE-2024-34698 4.6 MediumMay 13, 2024
• freescout Freescout vulnerable to Stored HTML Injection in Editing Received Emails CVE-2024-34697 7.6 HighMay 13, 2024
• freescout FreeScout OS Command Injection vulnerability CVE-2024-29185 9.1 CriticalMarch 22, 2024
• freescout FreeScout Stored XSS to Privilege Escalation After CSP Bypass CVE-2024-29184 8.0 HighMarch 22, 2024
• freescout SMTP Mail Credentials Disclosed in Error Log in freescout CVE-2024-28186 7.1 HighMarch 12, 2024
• freescout, freescout-helpdesk freescout-helpdesk/freescout +1 more Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout CVE-2024-1932 6.1 MediumFebruary 28, 2024