Security Vulnerabilities
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of all support tickets.
CVSS Score
4.3
EPSS Score
0.0
Published
2025-11-21
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the role and capabilities of any user with an Administrator, WSDesk Supervisor, or WSDesk Agents role.
CVSS Score
5.3
EPSS Score
0.0
Published
2025-11-21
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score
9.8
EPSS Score
0.003
Published
2025-11-21
Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows). If exploited, arbitrary code may be executed with the privilege of the user invoking the installer.
CVSS Score
7.8
EPSS Score
0.0
Published
2025-11-21
Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-11-21
LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.
CVSS Score
4.9
EPSS Score
0.0
Published
2025-11-21
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.
CVSS Score
5.0
EPSS Score
0.0
Published
2025-11-21
A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score
7.3
EPSS Score
0.0
Published
2025-11-21
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
CVSS Score
8.0
EPSS Score
0.001
Published
2025-11-20
Microsoft SharePoint Online Elevation of Privilege Vulnerability
CVSS Score
9.8
EPSS Score
0.004
Published
2025-11-20