Back
Vendor security profile
Kayako
Click a year for its months, then a month to list its CVEs.
Unscored (96%): no CVSS from NVD yet, not a sign the CVE is harmless.
Latest CVEs for Kayako
6.5CVSS
CVE-2020-2500 · Jul 01, 2020
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnera…
QNAPHELPDESKMODIFIED
MEDIUM
4.3CVSS
CVE-2012-3233 · Sep 15, 2012
Cross-site scripting (XSS) vulnerability in __swift/thirdparty/PHPExcel/PHPExcel/Shared/JAMA/docs/download.php in Kayako Fusion 4.40.1148, and possibly before 4.50.1581, allows remote attackers to inject arbitrary web script or HTML via the…
PoC availableKAYAKOFUSION 4.40.1148MODIFIED
MEDIUM
4.3CVSS
CVE-2012-4872 · Sep 06, 2012
Cross-site scripting (XSS) vulnerability in Tickets/Submit in Kayako Fusion before 4.40.985 allows remote attackers to inject arbitrary web script or HTML via certain vectors, possibly a crafted ticket description.
KAYAKOKAYAKO FUSIONMODIFIED
MEDIUM
7.5CVSS
CVE-2010-2912 · Jul 28, 2010
SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL commands via the _a parameter in a downloads action.
PoC availableKAYAKOESUPPORT 3.70.02MODIFIED
HIGH
7.5CVSS
CVE-2010-2911 · Jul 28, 2010
SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a viewnews action.
PoC availableKAYAKOESUPPORT 3.70.02MODIFIED
HIGH
3.5CVSS
CVE-2010-0460 · Jan 28, 2010
Multiple cross-site scripting (XSS) vulnerabilities in staff/index.php in Kayako SupportSuite 3.60.04 and earlier allow remote authenticated users to inject arbitrary web script or HTML via the (1) subject parameter and (2) contents paramet…
PoC availableKAYAKOESUPPORTMODIFIED
LOW
4.3CVSS
CVE-2009-3567 · Oct 06, 2009
Cross-site scripting (XSS) vulnerability in modules/tickets/functions_ticketsui.php in Kayako SupportSuite and eSupport 3.60.04 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the staff …
KAYAKOESUPPORTMODIFIED
MEDIUM
4.3CVSS
CVE-2009-3427 · Sep 25, 2009
Cross-site scripting (XSS) vulnerability in Kayako SupportSuite 3.50.06 allows remote attackers to inject arbitrary web script or HTML via the subject field in a ticket.
PoC availableKAYAKOSUPPORTSUITE 3.50.06MODIFIED
MEDIUM
4.3CVSS
CVE-2008-4761 · Oct 28, 2008
Cross-site scripting (XSS) vulnerability in includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php in Kayako eSupport 3.20.2 allows remote attackers to inject arbitrary web script or HTML via the jsMakeSrc parameter. NOTE: the provenance o…
PoC availableKAYAKOESUPPORT 3.20.2MODIFIED
MEDIUM
4.3CVSS
CVE-2008-3700 · Aug 15, 2008
Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite 3.20.02 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the sessionid parameter in a livesupport startclientchat action to visitor/…
Likely exploitedKAYAKOSUPPORTSUITEMODIFIED
MEDIUM
6.5CVSS
CVE-2008-3701 · Aug 15, 2008
SQL injection vulnerability in staff/index.php in Kayako SupportSuite 3.20.02 and earlier allows remote authenticated users to execute arbitrary SQL commands via the customfieldlinkid parameter in a delcflink action.
KAYAKOSUPPORTSUITEMODIFIED
MEDIUM
5.0CVSS
CVE-2008-0395 · Jan 23, 2008
Kayako SupportSuite 3.11.01 allows remote attackers to obtain server configuration information via a direct request to syncml/index.php, which prints the contents of the $_SERVER superglobal.
KAYAKOSUPPORTSUITE 3.11.01MODIFIED
MEDIUM
4.3CVSS
CVE-2007-2562 · May 09, 2007
Cross-site scripting (XSS) vulnerability in index.php in Kayako eSupport 3.00.90 allows remote attackers to inject arbitrary web script or HTML via the _m parameter.
KAYAKOESUPPORT 3.00.90MODIFIED
MEDIUM
4.3CVSS
CVE-2007-1145 · Mar 02, 2007
Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite - ESupport 3.00.13 and 3.04.10 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a (1) lostpassword or (2) register ac…
KAYAKOESUPPORT 3.00.13MODIFIED
MEDIUM
4.3CVSS
CVE-2006-5825 · Nov 10, 2006
Cross-site scripting (XSS) vulnerability in index.php in Kayako SupportSuite 3.00.32 allows remote attackers to inject arbitrary web script or HTML via the query string.
PoC availableKAYAKOSUPPORTSUITE 3.00.32MODIFIED
MEDIUM
2.6CVSS
CVE-2006-4011 · Aug 07, 2006
PHP remote file inclusion vulnerability in esupport/admin/autoclose.php in Kayako eSupport 2.3.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the subd parameter.
PoC availableKAYAKOESUPPORT 2.3MODIFIED
LOW
5.8CVSS
CVE-2005-2460 · Dec 31, 2005
Multiple cross-site scripting (XSS) vulnerabilities in Kayako liveResponse 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter or (2) name field when entering a session or sending a message.
PoC availableKAYAKOLIVERESPONSE 2.0MODIFIED
MEDIUM
6.4CVSS
CVE-2005-2461 · Dec 31, 2005
Multiple SQL injection vulnerabilities in the calendar feature in Kayako liveResponse 2.x allow remote attackers to execute arbitrary SQL commands via the (1) year or (2) date parameter.
KAYAKOLIVERESPONSE 2.0MODIFIED
MEDIUM
2.1CVSS
CVE-2005-2462 · Dec 31, 2005
Kayako liveResponse 2.x, when logging in a user, records the password in plaintext in the URL, which allows local users and possibly remote attackers to gain privileges.
KAYAKOLIVERESPONSE 2.0MODIFIED
LOW
6.4CVSS
CVE-2005-2463 · Dec 31, 2005
Kayako liveResponse 2.x allows remote attackers to obtain sensitive information via a direct request to addressbook.php and other include scripts, which reveals the path in an error message.
PoC availableKAYAKOLIVERESPONSE 2.0MODIFIED
MEDIUM