CVE-2026-114396

HighCVSS 7.1/10Last modified Oct 30, 2026

Description

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-943

Affected software

Vendor	Product	Versions
polonel	trudesk	<= 1.2.11

References

https://github.com/polonel/trudeskProduct
https://github.com/polonel/trudesk/blob/v1.2.11/src/models/ticket.js#L1184-L1215Patch
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211Exploit, Third Party Advisory
https://www.vulncheck.com/advisories/trudesk-through-1.2.11-mongodb-where-injection-via-tickets-search-apiThird Party Advisory
https://hackmd.io/@leediay/multiple-vuln-trudesk-1211Exploit, Third Party Advisory

Timeline

Published: Oct 21, 2026
Last modified: Oct 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1143977.4Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthent CVE-2026-1143985.4Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in t CVE-2026-1143996.5Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded tra CVE-2026-11448.8A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atom CVE-2026-114406.3A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-CVE-2026-1144007.5Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket atta CVE-2026-1144015.3Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by CVE-2026-1144024.3Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authen CVE-2026-1144038.1PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PH CVE-2026-1144046.1PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentati CVE-2026-1144058.7Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 3 CVE-2026-1144066.8The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA cer