Known vulnerabilities in Web Help Desk 12.8.3 Hotfix 3

Vendor: SolarWinds
Software: Web Help Desk
Version: 12.8.3 Hotfix 3
Software CPE: cpe:2.3:a:solarwinds:whd:*:*:*:*:*:*:*:*
Total vulnerabilities: 16
Public exploits: 5
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Web Help Desk version 12.8.3 Hotfix 3 Web Help Desk 12.8.3 Hotfix 3 is affected by 16 vulnerabilities: 5 critical, 2 high, 7 medium, 2 low Critical High Medium Low

Vulnerabilities (16)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU139619 - Resource exhaustion
CVE-2026-28299
CWE-400 High
No
No
2026.2 27.07.2026 SB20260727222
#VU122156 - Deserialization of Untrusted Data
CVE-2025-40551
CWE-502 Critical
Public exploit available
Exploited
2026.1 30.01.2026 SB2026013035
#VU122155 - Improper Authentication
CVE-2025-40552
CWE-287 Critical
Public exploit available
No
2026.1 30.01.2026 SB2026013035
#VU122154 - Deserialization of Untrusted Data
CVE-2025-40553
CWE-502 Critical
Public exploit available
No
12.8.8 Hotfix 2, 2026.1 30.01.2026 SB2026013035
#VU122153 - Improper Authentication
CVE-2025-40554
CWE-287 Critical
Public exploit available
No
2026.1 30.01.2026 SB2026013035
#VU122152 - Improper Access Control
CVE-2025-40536
CWE-284 High
Public exploit available
Exploited
2026.1 30.01.2026 SB2026013035
#VU122151 - Use of Hard-coded Credentials
CVE-2025-40537
CWE-798 Medium
No
No
2026.1 30.01.2026 SB2026013035
#VU116030 - Deserialization of Untrusted Data
CVE-2025-26399
CWE-502 Critical
No
Exploited
12.8.7 Hotfix 1 23.09.2025 SB2025092357
#VU113572 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-26400
CWE-611 Medium
No
No
12.8.7 01.08.2025 SB2025080107
#VU104167 - Use of Hard-coded Cryptographic Key
CVE-2024-28989
CWE-321 Low
No
No
12.8.5 25.02.2025 SB2025022513
#VU101367 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-45709
CWE-22 Medium
No
No
12.8.4 10.12.2024 SB2024121004
#VU100588 - Improper Authentication
CVE-2024-52316
CWE-287 Low
No
No
12.8.4 18.11.2024 SB2024111823
SB2024112550
SB2024112832
and 36 more
#VU99556 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2024-48910
CWE-1321 Medium
No
No
12.8.4 31.10.2024 SB2024103154
SB2024111356
SB2024112007
and 15 more
#VU99261 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47875
CWE-79 Medium
No
No
12.8.4 22.10.2024 SB20241022382
SB20241022383
SB20241022392
and 27 more
#VU97758 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2024-45801
CWE-1321 Medium
No
No
12.8.4 27.09.2024 SB2024092751
SB2024100823
SB2024100827
and 32 more
#VU49403 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-26870
CWE-79 Medium
No
No
12.8.4 07.10.2020 SB2021011214
SB2021072052
SB2020100725
and 4 more