# cve.now: Polonel

The newest entries naming Polonel as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114402](https://cve.now/CVE-2026-114402.md): Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload (CVSS 5.3)
- [CVE-2026-114401](https://cve.now/CVE-2026-114401.md): Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login (CVSS 6.9)
- [CVE-2026-114400](https://cve.now/CVE-2026-114400.md): Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads (CVSS 8.2)
- [CVE-2026-114399](https://cve.now/CVE-2026-114399.md): Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API (CVSS 7.0)
- [CVE-2026-114398](https://cve.now/CVE-2026-114398.md): Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo (CVSS 5.1)
- [CVE-2026-114397](https://cve.now/CVE-2026-114397.md): Trudesk through 1.2.11 Missing Authentication on Debug Routes (CVSS 8.3)
- [CVE-2026-114396](https://cve.now/CVE-2026-114396.md): Trudesk through 1.2.11 MongoDB $where Injection via tickets search API (CVSS 7.1)
- [CVE-2026-114395](https://cve.now/CVE-2026-114395.md): Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send (CVSS 5.3)
- [CVE-2026-114394](https://cve.now/CVE-2026-114394.md): Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs (CVSS 5.3)
- [CVE-2026-114393](https://cve.now/CVE-2026-114393.md): Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints (CVSS 5.3)
- [CVE-2026-114392](https://cve.now/CVE-2026-114392.md): Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid (CVSS 6.9)
- [CVE-2026-111345](https://cve.now/CVE-2026-111345.md): Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id (CVSS 5.3)
- [CVE-2022-2128](https://cve.now/CVE-2022-2128.md): Unrestricted Upload of File with Dangerous Type in polonel/trudesk (CVSS 9.6)
- [CVE-2022-2023](https://cve.now/CVE-2022-2023.md): Incorrect Use of Privileged APIs in polonel/trudesk (CVSS 10.0)
- [CVE-2022-1947](https://cve.now/CVE-2022-1947.md): Use of Incorrect Operator in polonel/trudesk (CVSS 9.1)
- [CVE-2022-1808](https://cve.now/CVE-2022-1808.md): Execution with Unnecessary Privileges in polonel/trudesk (CVSS 8.8)
- [CVE-2022-1893](https://cve.now/CVE-2022-1893.md): Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk (CVSS 4.6)
- [CVE-2022-1926](https://cve.now/CVE-2022-1926.md): Integer Overflow or Wraparound in polonel/trudesk (CVSS 7.6)
- [CVE-2022-1931](https://cve.now/CVE-2022-1931.md): Incorrect Synchronization in polonel/trudesk (CVSS 9.1)
- [CVE-2022-1752](https://cve.now/CVE-2022-1752.md): Unrestricted Upload of File with Dangerous Type in polonel/trudesk (CVSS 9.0)
- [CVE-2022-1775](https://cve.now/CVE-2022-1775.md): Weak Password Requirements in polonel/trudesk (CVSS 8.4)
- [CVE-2022-1803](https://cve.now/CVE-2022-1803.md): Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk (CVSS 8.4)
- [CVE-2022-1770](https://cve.now/CVE-2022-1770.md): Improper Privilege Management in polonel/trudesk (CVSS 9.9)
- [CVE-2022-1754](https://cve.now/CVE-2022-1754.md): Integer Overflow or Wraparound in polonel/trudesk (CVSS 8.4)
- [CVE-2022-1728](https://cve.now/CVE-2022-1728.md): Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk (CVSS 7.6)
- [CVE-2022-1718](https://cve.now/CVE-2022-1718.md): The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk (CVSS 7.2)
- [CVE-2022-1719](https://cve.now/CVE-2022-1719.md): Reflected XSS on ticket filter function in polonel/trudesk (CVSS 5.5)
- [CVE-2022-1044](https://cve.now/CVE-2022-1044.md): Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk (CVSS 8.2)
- [CVE-2022-1045](https://cve.now/CVE-2022-1045.md): Stored XSS viva .svg file upload in polonel/trudesk (CVSS 9.0)
- [CVE-2022-1290](https://cve.now/CVE-2022-1290.md): Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk (CVSS 9.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/polonel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.