Product by Polonel

    Trudesk

    30 known vulnerabilities in Trudesk (Polonel), 0 of them actively exploited (CISA KEV).

    Key figures

    30

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    9

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Trudesk (Polonel)
    CriticalCVE-2022-2023

    Incorrect Use of Privileged APIs in polonel/trudesk

    also in 2 other products

    		10.0
    HighCVE-2022-1808

    Execution with Unnecessary Privileges in polonel/trudesk

    also in 2 other products

    		8.8
    CriticalCVE-2022-2128

    Unrestricted Upload of File with Dangerous Type in polonel/trudesk

    also in 2 other products

    		9.6
    CriticalCVE-2022-1770

    Improper Privilege Management in polonel/trudesk

    also in 2 other products

    		9.9
    CriticalCVE-2022-1775

    Weak Password Requirements in polonel/trudesk

    also in 2 other products

    		8.4
    CriticalCVE-2022-1752

    Unrestricted Upload of File with Dangerous Type in polonel/trudesk

    also in 2 other products

    		9.0
    CriticalCVE-2022-1931

    Incorrect Synchronization in polonel/trudesk

    also in 2 other products

    		9.1
    CriticalCVE-2022-1290

    Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk

    also in 2 other products

    		9.0
    HighCVE-2026-114397

    Trudesk through 1.2.11 Missing Authentication on Debug Routes

    also in 1 other product

    		7.4
    CriticalCVE-2022-1045

    Stored XSS viva .svg file upload in polonel/trudesk

    also in 2 other products

    		9.0
    HighCVE-2022-1803

    Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk

    also in 2 other products

    		8.4
    HighCVE-2026-114400

    Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

    also in 1 other product

    		7.5
    CriticalCVE-2022-1947

    Use of Incorrect Operator in polonel/trudesk

    also in 2 other products

    		9.1
    HighCVE-2026-114399

    Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

    also in 1 other product

    		6.5
    HighCVE-2026-114396

    Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

    also in 1 other product

    		7.1
    MediumCVE-2026-114401

    Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

    also in 1 other product

    		5.3
    MediumCVE-2026-114392

    Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid

    also in 1 other product

    		5.3
    HighCVE-2022-1754

    Integer Overflow or Wraparound in polonel/trudesk

    also in 2 other products

    		8.4
    HighCVE-2022-1044

    Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk

    also in 2 other products

    		8.2
    HighCVE-2022-1718

    Polonel/trudesk: Integer Overflow or Wraparound

    also in 2 other products

    		7.2
    HighCVE-2022-1926

    Integer Overflow or Wraparound in polonel/trudesk

    also in 2 other products

    		7.6
    HighCVE-2022-1728

    Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk

    also in 2 other products

    		7.6
    MediumCVE-2026-114402

    Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload

    also in 1 other product

    		4.3
    MediumCVE-2026-114395

    Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send

    also in 1 other product

    		4.3
    MediumCVE-2026-114394

    Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

    also in 1 other product

    		4.3

    All vulnerabilities in search

    All products by Polonel