CVE-2023-26982

moderate-risk

Published 2023-03-29

Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter under the Create Ticket function.

Do I need to act?

1.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Trudesk

Affected Vendors

Trudesk Project

References (6)

Exploit https://github.com/bypazs/CVE-2023-26982

Release Notes https://github.com/polonel/trudesk/releases/tag/v1.2.6

Product https://trudesk.io/

Exploit https://github.com/bypazs/CVE-2023-26982

Release Notes https://github.com/polonel/trudesk/releases/tag/v1.2.6

Product https://trudesk.io/

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 4/34 · Minimal

Exposure 5/34 · Minimal