CVE-2019-20002: SolarWinds Webhelpdesk

High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help request form) that is mishandled in a TicketActions/view?tab=group TSV export by an admin user.

Affected products

• SolarWinds Webhelpdesk: version 12.7.1 only

Published 2020-04-27. Last modified 2026-06-17.