CVE Intelligence

vsDesk vulnerabilities

🔔 Create alert RSS

Published CVEs affecting vsDesk products: 4 record(s), with severity, exploitation and fixes.

vsDesk 4

Exploited only (KEV) →

CVE-2025-14601 High · 8.6 CWE-676 Aug 20, 2026
vsDesk Task Scheduler OS Command Injection
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
CVE-2025-14602 Medium · 5.3 CWE-340 Aug 20, 2026
Weak File Name Generation in vsDesk
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
CVE-2025-14603 High · 8.8 Aug 19, 2026
Use of user input in raw SQL queries in vsDesk leading to blind SQL injection
The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive.  Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
CVE-2025-14600 Critical · 9.3 CWE-305 Aug 19, 2026
Admin Account Takeover via Path Traversal in vsDesk
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.