CVE-2025-71419 — UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration ac…
Published: 2026-09-21 · CVSS: 5.1 · CVSS 4.0
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7