Medium
CVE-2026-94378
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 24
Reset filters
Medium
CVE-2026-94539
SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
Medium
CVE-2026-81022
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 - 3.5.2 - Unauthenticated Information Exposure
Medium
CVE-2026-81021
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Read
Medium
CVE-2026-73350
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization
Medium
CVE-2026-57711
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.4.8 - Authenticated (Customer+) Stored Cross-Site Scripting
Medium
CVE-2026-54826
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-0683
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
Medium
CVE-2026-25321
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Missing Authorization
Medium
CVE-2026-1251
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2025-67598
SupportCandy <= 3.4.1 - Cross-Site Request Forgery
Medium
CVE-2025-10658
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
Medium
CVE-2024-13552
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference
Medium
CVE-2024-27991
SupportCandy <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2023-2719
SupportCandy <= 3.1.6 - Authenticated (Subscriber+) SQL Injection
High
CVE-2023-2805
SupportCandy <= 3.1.6 - Authenticated (Admin+) SQL Injection
Critical
CVE-2023-1730
SupportCandy <= 3.1.4 - Unauthenticated SQL Injection via parse_user_filters
Medium
07c0b4c5-d76e-4bdc-87d1-3144a1466c77
SupportCandy <= 3.1.3 - Sensitive Data Exposure
High
CVE-2021-24839
SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion
Medium
CVE-2021-24878
SupportCandy <= 2.2.6 - Reflected Cross-Site Scripting
Medium
CVE-2021-24879
SupportCandy – Helpdesk & Support Ticket System <= 2.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2021-24880
SupportCandy <= 2.2.6 - Stored Cross-Site Scripting via Shortcode
Medium
CVE-2021-24843
SupportCandy <= 2.2.6 - Cross-Site Request Forgery to Arbitrary Ticket Deletion
Critical
CVE-2019-11223
SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.