CVE-2025-71419

Name of the Vulnerable Software and Affected Versions UVdesk core-framework versions prior to 1.1.7

Description A stored cross-site scripting issue exists in the createMailerConfiguration action. Users with ROLE AGENT privileges can inject malicious scripts into the identifier parameter of the SwiftMailer configuration. This script is stored on the server and executes when other members view the configuration update page.

Recommendations Update UVdesk core-framework to version 1.1.7 or later. As a temporary mitigation, restrict access to the createMailerConfiguration action for users with ROLE AGENT privileges.