Product by Freescout-help-desk
Freescout
85 known vulnerabilities in Freescout (Freescout-help-desk), 0 of them actively exploited (CISA KEV).
Key figures
85
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
11
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-28289 | Freescout: Unrestricted Upload of File with Dangerous Type | 10.0 | |
| Critical | CVE-2026-53595 | FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL | 9.4 | |
| High | CVE-2026-27636 | FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache | 8.8 | |
| Critical | CVE-2025-48471 | FreeScout Vulnerable to Arbitrary File Upload | 9.8 | |
| High | CVE-2025-54366 | FreeScout's deserialization of untrusted data leads to Remote Code Execution | 8.8 | |
| Critical | CVE-2026-27637 | FreeScout's Predictable Authentication Token Enables Account Takeover | 9.8 | |
| High | CVE-2025-48389 | FreeScout Vulnerable to Deserialization of Untrusted Data | 7.2 | |
| Critical | CVE-2026-40498 | FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron | 9.8 | |
| High | CVE-2025-48390 | FreeScout Vulnerable to Remote Code Execution (RCE) | 7.2 | |
| Critical | CVE-2026-32754 | FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) | 9.3 | |
| High | CVE-2025-58163 | FreeScout's deserialization of untrusted data can lead to Remote Code Execution | 8.8 | |
| Critical | CVE-2025-48481 | FreeScout Has Business Logic Errors | 9.8 | |
| High | CVE-2026-48812 | FreeScout Allows Unauthenticated Access to Legacy Attachment Files | 7.5 | |
| Critical | CVE-2026-40496 | Freescout: Use of Insufficiently Random Values | 9.1 | |
| High | CVE-2026-53593 | Freescout: Unrestricted Upload of File with Dangerous Type | 8.8 | |
| High | CVE-2026-85743 | Freescout: Server-Side Request Forgery (SSRF) | 8.2 | |
| Critical | CVE-2026-41193 | Freescout: Path Traversal | 9.1 | |
| High | CVE-2025-48476 | FreeScout Has Business Logic Errors | 8.8 | |
| High | CVE-2026-62856 | Freescout: SQL Injection | 7.7 | |
| High | CVE-2026-62854 | FreeScout: Stored XSS in mailbox signature via same-origin JS upload | 7.6 | |
| High | CVE-2026-85742 | FreeScout: Conditional stored admin XSS via failed-job details | 7.5 | |
| High | CVE-2026-53591 | Freescout: Improper Authentication | 8.6 | |
| High | CVE-2026-103985 | Freescout: Improper Privilege Management | 7.1 | |
| Critical | CVE-2026-40569 | FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration | 9.0 | |
| High | CVE-2025-48477 | FreeScout Has Business Logic Errors | 8.1 |