CVE-2024-46226: Helpdeskz

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket.

Affected products

• Helpdeskz Helpdeskz: before 2.0.2 (fixed in 2.0.2)

Published 2025-02-26. Last modified 2026-06-17.