freescout records

46 published records for vendor freescout.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 2 · 4.3%
Pre-auth RCE: 2
With a fix record: 76.1%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

46 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-27637No exploit	FreeScout's Predictable Authentication Token Enables Account Takeoverfreescout · freescout · CWE-330 Pre-auth Weak crypto	Critical9.8	—	0.8%	Feb 25, 2026
37Monitor	CVE-2024-29185No exploit	FreeScout OS Command Injection vulnerabilityfreescout · freescout · CWE-78 pre-auth RCE Command injection	Critical9.0	—	1.7%	Mar 22, 2024
37Monitor	CVE-2026-32754No exploit	FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})freescout · freescout · CWE-79 Pre-auth XSS	Critical9.3	—	0.6%	Mar 19, 2026
36Monitor	CVE-2026-27636Weaponized	FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apachefreescout · freescout · CWE-434 RCE File upload	High8.8	—	2.1%	Feb 25, 2026
35Monitor	CVE-2026-40498No exploit	FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cronfreescout · freescout · CWE-200 Pre-auth Auth bypass Info leak	High8.9	—	0.7%	Apr 21, 2026
35Monitor	CVE-2026-40496No exploit	FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Forcefreescout · freescout · CWE-330 Pre-auth Weak crypto	High8.8	—	0.5%	Apr 20, 2026
34Monitor	CVE-2025-54366No exploit	FreeScout's deserialization of untrusted data leads to Remote Code Executionfreescout · freescout · CWE-502 RCE Deserialization	High8.6	—	1.0%	Jul 26, 2025
34Monitor	CVE-2025-48389No exploit	FreeScout Vulnerable to Deserialization of Untrusted Datafreescout · freescout · CWE-502 RCE Deserialization	High8.6	—	0.9%	May 29, 2025
34Monitor	CVE-2025-48390No exploit	FreeScout Vulnerable to Remote Code Execution (RCE)freescout · freescout · CWE-94 RCE	High8.6	—	0.9%	May 29, 2025
34Monitor	CVE-2025-58163No exploit	FreeScout's deserialization of untrusted data can lead to Remote Code Executionfreescout · freescout · CWE-502 RCE Deserialization	High8.6	—	0.7%	Sep 2, 2025
34Monitor	CVE-2025-48479No exploit	FreeScout Has Business Logic Errorsfreescout · freescout · CWE-841	High8.5	—	0.3%	May 30, 2025
34Monitor	CVE-2026-32753No exploit	FreeScout: Stored XSS through SVG file upload with filter bypassfreescout · freescout · CWE-80 XSS	High8.5	—	0.3%	Mar 19, 2026
33Monitor	CVE-2026-28289Weaponized	FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Executionfreescout · freescout · CWE-434 pre-auth RCE File upload Race condition	High8.1	—	2.6%	Mar 3, 2026
32Monitor	CVE-2024-29184No exploit	FreeScout Stored XSS to Privilege Escalation After CSP Bypassfreescout · freescout · CWE-79 XSS	High8.0	—	0.9%	Mar 22, 2024
32Monitor	CVE-2026-32752No exploit	FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messagesfreescout · freescout · CWE-284 Broken access control (IDOR)	High8.1	—	0.4%	Mar 19, 2026
32Monitor	CVE-2026-40497No exploit	FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)freescout · freescout · CWE-79 XSS CSRF	High8.1	—	0.4%	Apr 20, 2026
30Monitor	CVE-2026-39384No exploit	FreeScout Customer Merge Cross-Mailbox Authorization Bypassfreescout · freescout · CWE-639 Broken access control (IDOR)	High7.6	—	0.3%	Apr 7, 2026
28Monitor	CVE-2025-48471No exploit	FreeScout Vulnerable to Arbitrary File Uploadfreescout · freescout · CWE-434 RCE File upload	High7.0	—	1.1%	May 29, 2025
28Monitor	CVE-2024-28186No exploit	SMTP Mail Credentials Disclosed in Error Log in freescoutfreescout · freescout · CWE-532 Info leak	High7.1	—	0.6%	Mar 12, 2024
28Monitor	CVE-2025-48476No exploit	FreeScout Has Business Logic Errorsfreescout · freescout · CWE-841	High7.1	—	0.5%	May 30, 2025
28Monitor	CVE-2025-48477No exploit	FreeScout Has Business Logic Errorsfreescout · freescout · CWE-841	High7.1	—	0.5%	May 30, 2025
28Monitor	CVE-2025-48478No exploit	FreeScout Has Business Logic Errorsfreescout · freescout · CWE-841	High7.0	—	0.4%	May 30, 2025
28Monitor	CVE-2025-48388No exploit	FreeScout Has Insufficient Protection Against CRLF-injectionfreescout · freescout · CWE-93	High7.0	—	0.4%	May 29, 2025
28Monitor	CVE-2025-48480No exploit	FreeScout Has Business Logic Errorsfreescout · freescout · CWE-841	High7.0	—	0.3%	May 30, 2025
27Monitor	CVE-2025-48472No exploit	FreeScout Vulnerable to Insufficient Authorizationfreescout · freescout · CWE-863 Pre-auth Broken access control (IDOR)	Medium6.9	—	0.4%	May 29, 2025

CVE-2026-27637
39Monitor
FreeScout's Predictable Authentication Token Enables Account Takeover
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Weak crypto
freescout · freescoutFeb 25, 2026
CVE-2024-29185
37Monitor
FreeScout OS Command Injection vulnerability
CriticalCVSS 9.0No exploitEPSS 2%
- pre-auth RCE
- Command injection
freescout · freescoutMar 22, 2024
CVE-2026-32754
37Monitor
FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- XSS
freescout · freescoutMar 19, 2026
CVE-2026-27636
36Monitor
FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache
HighCVSS 8.8WeaponizedEPSS 2%
- RCE
- File upload
freescout · freescoutFeb 25, 2026
CVE-2026-40498
35Monitor
FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
- Auth bypass
- Info leak
freescout · freescoutApr 21, 2026
CVE-2026-40496
35Monitor
FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- Weak crypto
freescout · freescoutApr 20, 2026
CVE-2025-54366
34Monitor
FreeScout's deserialization of untrusted data leads to Remote Code Execution
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Deserialization
freescout · freescoutJul 26, 2025
CVE-2025-48389
34Monitor
FreeScout Vulnerable to Deserialization of Untrusted Data
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Deserialization
freescout · freescoutMay 29, 2025
CVE-2025-48390
34Monitor
FreeScout Vulnerable to Remote Code Execution (RCE)
HighCVSS 8.6No exploitEPSS 1%
- RCE
freescout · freescoutMay 29, 2025
CVE-2025-58163
34Monitor
FreeScout's deserialization of untrusted data can lead to Remote Code Execution
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Deserialization
freescout · freescoutSep 2, 2025
CVE-2025-48479
34Monitor
FreeScout Has Business Logic Errors
HighCVSS 8.5No exploitEPSS 0%
freescout · freescoutMay 30, 2025
CVE-2026-32753
34Monitor
FreeScout: Stored XSS through SVG file upload with filter bypass
HighCVSS 8.5No exploitEPSS 0%
- XSS
freescout · freescoutMar 19, 2026
CVE-2026-28289
33Monitor
FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
HighCVSS 8.1WeaponizedEPSS 3%
- pre-auth RCE
- File upload
- Race condition
freescout · freescoutMar 3, 2026
CVE-2024-29184
32Monitor
FreeScout Stored XSS to Privilege Escalation After CSP Bypass
HighCVSS 8.0No exploitEPSS 1%
- XSS
freescout · freescoutMar 22, 2024
CVE-2026-32752
32Monitor
FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
freescout · freescoutMar 19, 2026
CVE-2026-40497
32Monitor
FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)
HighCVSS 8.1No exploitEPSS 0%
- XSS
- CSRF
freescout · freescoutApr 20, 2026
CVE-2026-39384
30Monitor
FreeScout Customer Merge Cross-Mailbox Authorization Bypass
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
freescout · freescoutApr 7, 2026
CVE-2025-48471
28Monitor
FreeScout Vulnerable to Arbitrary File Upload
HighCVSS 7.0No exploitEPSS 1%
- RCE
- File upload
freescout · freescoutMay 29, 2025
CVE-2024-28186
28Monitor
SMTP Mail Credentials Disclosed in Error Log in freescout
HighCVSS 7.1No exploitEPSS 1%
- Info leak
freescout · freescoutMar 12, 2024
CVE-2025-48476
28Monitor
FreeScout Has Business Logic Errors
HighCVSS 7.1No exploitEPSS 1%
freescout · freescoutMay 30, 2025
CVE-2025-48477
28Monitor
FreeScout Has Business Logic Errors
HighCVSS 7.1No exploitEPSS 0%
freescout · freescoutMay 30, 2025
CVE-2025-48478
28Monitor
FreeScout Has Business Logic Errors
HighCVSS 7.0No exploitEPSS 0%
freescout · freescoutMay 30, 2025
CVE-2025-48388
28Monitor
FreeScout Has Insufficient Protection Against CRLF-injection
HighCVSS 7.0No exploitEPSS 0%
freescout · freescoutMay 29, 2025
CVE-2025-48480
28Monitor
FreeScout Has Business Logic Errors
HighCVSS 7.0No exploitEPSS 0%
freescout · freescoutMay 30, 2025
CVE-2025-48472
27Monitor
FreeScout Vulnerable to Insufficient Authorization
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
freescout · freescoutMay 29, 2025