CVE-2024-46226

A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket.

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 18th percentile

Published

2025-02-26

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/52068

References

• CVE Record
• NVD entry

Related

• CVE-2024-46213
• CVE-2024-46236
• CVE-2024-46212
• CVE-2024-46238
• CVE-2024-4621
• CVE-2024-46239