CVE-2024-34697

FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Freescout Application. The vulnerability allows attackers to inject malicious HTML content into emails sent to the application's mailbox. This vulnerability arises from improper handling of HTML content within incoming emails, allowing attackers to embed malicious HTML code in the context of the application's domain. Unauthenticated attackers can exploit this vulnerability to inject malicious HTML content into emails. This could lead to various attacks such as form hijacking, application defacement, or data exfiltration via CSS injection. Although unauthenticated attackers are limited to HTML injection, the consequences can still be severe. Version 1.8.139 implements strict input validation and sanitization mechanisms to ensure that any HTML content received via emails is properly sanitized to prevent malicious HTML injections.

• CWE-74
• CWE-79

• https://github.com/freescout-helpdesk/freescout/commit/99a4b4b4e153c82e273e549b9efbf6db4a2d8328Patch
• https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-985r-6qfc-hg8mExploit, Vendor Advisory
• https://github.com/freescout-helpdesk/freescout/commit/99a4b4b4e153c82e273e549b9efbf6db4a2d8328Patch
• https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-985r-6qfc-hg8mExploit, Vendor Advisory

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34691Manage Incoming Payment Files (F1680) of SAP S/4HANA does no…6.5
• CVE-2024-34692Due to missing verification of file type or content, SAP Ena…4.6
• CVE-2024-34693Improper Input Validation vulnerability in Apache Superset, …5.3
• CVE-2024-34694LNbits is a Lightning wallet and accounts system. Paying inv…8.1
• CVE-2024-34695WOWS Karma is a reputation system for Wargaming's World of W…6.3
• CVE-2024-34696GeoServer is an open source server that allows users to shar…4.9
• CVE-2024-34698FreeScout is a free, self-hosted help desk and shared mailbo…6.3
• CVE-2024-34699GZ::CTF is a capture the flag platform. Prior to 0.20.1, unp…6.5
• CVE-2024-3470An Improper Privilege Management vulnerability was identifie…7.2
• CVE-2024-34701CreateWiki is Miraheze's MediaWiki extension for requesting …5.9
• CVE-2024-34702Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-34703Botan is a C++ cryptography library. X.509 certificates can …7.5