CVE-2025-52184

MEDIUM

helpy.io helpy 2.8.0 - Cross-Site Scripting via New Topic Ticket Function

Title source: llm

Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion.

Core 2

Core References

Product

Exploit, Third Party Advisory

CVSS v3 6.1

EPSS 0.0032

EPSS Percentile 24.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-79

Status published

Products (1)

helpy.io/helpy 2.8.0

Published Aug 26, 2025

Tracked Since Feb 18, 2026