CVE-2025-48482
MEDIUMDescription
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is updated using the fill() method, which processes fields such as channel and channel_id. However, the fill() method is called with all client-provided data, including unexpected values for channel and channel_id, leading to a mass assignment vulnerability. This issue has been patched in version 1.8.180.
Is your site exposed to CVE-2025-48482?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| freescout | freescout |
References
Frequently Asked Questions
What is CVE-2025-48482? +
How severe is CVE-2025-48482? +
What products are affected by CVE-2025-48482? +
How do I check if I'm vulnerable to CVE-2025-48482? +
Related Vulnerabilities
Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful …
Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status …
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a …
Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification …
Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful …
Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status …