Skip to contentFreescout-help-desk Freescout vulnerabilities
- freescoutFreeScout Customer Merge Cross-Mailbox Authorization BypassCVE-2026-393847.6 High
- freescoutFreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScoutCVE-2026-344425.4 Medium
- freescoutFreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()CVE-2026-344436.9 Medium
- freescoutFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})CVE-2026-327549.3 Critical
- freescoutFreeScout: Stored XSS through SVG file upload with filter bypassCVE-2026-327538.5 High
- freescoutFreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer MessagesCVE-2026-327520.0 None
- freescoutFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionCVE-2026-28289Public exploitEPSS 35.1%10.0 Critical
- freescoutFreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on ApacheCVE-2026-27636Public exploit8.8 High
- freescoutFreeScout's Predictable Authentication Token Enables Account TakeoverCVE-2026-276379.8 Critical
- freescoutFreeScout's deserialization of untrusted data can lead to Remote Code ExecutionCVE-2025-581638.6 High
- freescoutFreeScout's deserialization of untrusted data leads to Remote Code ExecutionCVE-2025-543668.6 High
- freescoutFreeScout Vulnerable to Stored XSSCVE-2025-484884.6 Medium
- freescoutFreeScout has Race Condition When Deleting UsersCVE-2025-488805.1 Medium
- freescoutFreeScout Vulnerable to Stored XSSCVE-2025-488754.6 Medium
- freescoutFreeScout Vulnerable to Stored XSSCVE-2025-484894.6 Medium
- freescoutFreeScout Vulnerable to Stored XSSCVE-2025-484876.0 Medium
- freescoutFreeScout Vulnerable to Stored XSSCVE-2025-484866.1 Medium
- freescoutFreeScout Vulnerable to Stored XSSCVE-2025-484856.1 Medium
- freescoutFreeScout Vulnerable to Stored XSSCVE-2025-484844.6 Medium
- freescoutFreeScout Stored XSS leads to CSRFCVE-2025-484836.3 Medium
- freescoutFreeScout Has Business Logic ErrorsCVE-2025-484825.3 Medium
- freescoutFreeScout Has Business Logic ErrorsCVE-2025-484816.1 Medium
- freescoutFreeScout Has Business Logic ErrorsCVE-2025-484807.0 High
- freescoutFreeScout Has Business Logic ErrorsCVE-2025-484798.5 High
- freescoutFreeScout Has Business Logic ErrorsCVE-2025-484787.0 High
- freescoutFreeScout Has Business Logic ErrorsCVE-2025-484777.1 High
- freescoutFreeScout Has Business Logic ErrorsCVE-2025-484767.1 High
- freescoutFreeScout Vulnerable to Insufficient AuthorizationCVE-2025-484755.3 Medium
- freescoutFreeScout Vulnerable to Insufficient AuthorizationCVE-2025-484745.3 Medium
- freescoutFreeScout Vulnerable to Insufficient AuthorizationCVE-2025-484735.3 Medium
- freescoutFreeScout Vulnerable to Insufficient AuthorizationCVE-2025-484726.9 Medium
- freescoutFreeScout Vulnerable to Arbitrary File UploadCVE-2025-484717.0 High
- freescoutFreeScout Vulnerable to Remote Code Execution (RCE)CVE-2025-483908.6 High
- freescoutFreeScout Vulnerable to Deserialization of Untrusted DataCVE-2025-483898.6 High
- freescoutFreeScout Has Insufficient Protection Against CRLF-injectionCVE-2025-483887.0 High
- freescoutPrototype Pollution in getQueryParam Function (URL Query Parser)CVE-2024-346984.6 Medium
- freescoutFreescout vulnerable to Stored HTML Injection in Editing Received EmailsCVE-2024-346977.6 High
- freescoutFreeScout OS Command Injection vulnerabilityCVE-2024-291859.1 Critical
- freescoutFreeScout Stored XSS to Privilege Escalation After CSP BypassCVE-2024-291848.0 High
- freescoutSMTP Mail Credentials Disclosed in Error Log in freescoutCVE-2024-281867.1 High