https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T19:55:03.389781+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-114396 CVE-2026-114396 — Trudesk through 1.2.11 MongoDB $where Injection via tickets search API 2026-11-11T19:55:03.391030+00:00

Affected: polonel trudesk

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.