Polonel vulnerabilities
30 CVEs and advisories name Polonel as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-114402Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
- CVE-2026-114401Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
- CVE-2026-114400Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
- CVE-2026-114399Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
- CVE-2026-114398Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
- CVE-2026-114397Trudesk through 1.2.11 Missing Authentication on Debug Routes
- CVE-2026-114396Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
- CVE-2026-114395Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
- CVE-2026-114394Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
- CVE-2026-114393Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
- CVE-2026-114392Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
- CVE-2026-111345Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id
- CVE-2022-2128Unrestricted Upload of File with Dangerous Type in polonel/trudesk
- CVE-2022-2023Incorrect Use of Privileged APIs in polonel/trudesk
- CVE-2022-1947Use of Incorrect Operator in polonel/trudesk
- CVE-2022-1808Execution with Unnecessary Privileges in polonel/trudesk
- CVE-2022-1893Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk
- CVE-2022-1926Integer Overflow or Wraparound in polonel/trudesk
- CVE-2022-1931Incorrect Synchronization in polonel/trudesk
- CVE-2022-1752Unrestricted Upload of File with Dangerous Type in polonel/trudesk
- CVE-2022-1775Weak Password Requirements in polonel/trudesk
- CVE-2022-1803Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk
- CVE-2022-1770Improper Privilege Management in polonel/trudesk
- CVE-2022-1754Integer Overflow or Wraparound in polonel/trudesk
- CVE-2022-1728Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk
- CVE-2022-1718The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk
- CVE-2022-1719Reflected XSS on ticket filter function in polonel/trudesk
- CVE-2022-1044Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk
- CVE-2022-1045Stored XSS viva .svg file upload in polonel/trudesk
- CVE-2022-1290Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk