Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
70 results · page 1 of 2
Aug 3, 2026osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing.CVE-2026-38447 · Other software · reported by MITRECritical 9.8
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field.CVE-2026-38446 · Other software · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name.CVE-2026-38444 · Other software · reported by MITREMedium 6.1
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. When an unauthenticated attacker sends a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4.CVE-2026-18363 · Other software · Enhancesoft LLC · reported by cve-coordination@incibe.esCritical 9.1
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account.
- Product
- osTicket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-mCVE-2026-14871 · Other software · osTicket · reported by help@fluidattacks.comHigh 7.1
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
- Product
- osTicket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Jul 14, 2026osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insuffiCVE-2026-36214 · Other software · osTicket · reported by MITREMedium 6.4
osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.
- Product
- osTicket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenhancesoft.comgithub.com
Jun 16, 2026A session fixation vulnerability has been identified in osTicket v1.18.2.CVE-2026-9507 · Other software · Enhancesoft · reported by cve-coordination@incibe.esMedium 5.1
A session fixation vulnerability has been identified in osTicket v1.18.2. This security flaw allows an attacker to hijack a victim’s account by keeping the initial session identifier (OSTSESSID) active after a successful login. The issue lies in the fact that the application does not invalidate the pre-authentication cookie or generate a new identifier for the authenticated context. As a result, if an attacker manages to set a known session identifier in the victim’s browser, they will be able to maintain unauthorised access to the account once the victim has authenticated.
- Product
- osTicket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026A security vulnerability has been detected in osTicket up to 1.18.3.CVE-2026-8194 · Other software · reported by VulDBLow 2.1
A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument _method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.CVE-2026-26895 · Other software · Enhancesoft · reported by MITREMedium 5.3
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionalCVE-2026-22200 · Other software · Enhancesoft · reported by VulnCheckHigh 8.7
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.
- Product
- osTicket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2025osTicket WP Bridge: Cross-Site Request ForgeryCVE-2025-9882 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The osTicket WP Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- osTicket WP Bridge
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update osTicket WP Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 2, 2025osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.CVE-2025-45387 · Other software · Osticket · reported by MITREMedium 5.4
osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL cCVE-2025-26241 · Other software · Enhancesoft · reported by MITREMedium 6.5
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Key4ce osTicket Bridge: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28877 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in m.tiggelaar Key4ce osTicket Bridge key4ce-osticket-bridge allows Reflected XSS.This issue affects Key4ce osTicket Bridge: from n/a through <= 1.4.0.
- Product
- Key4ce osTicket Bridge
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Key4ce osTicket Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2024Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted supportCVE-2023-46967 · Other software · enhancesoft · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket.
- Product
- osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsonarsource.comsonarsource.com
Oct 23, 2023A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaCVE-2023-27149 · Other software · Enhancesoft · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.comesecforte.com
Oct 23, 2023A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML vCVE-2023-27148 · Other software · Enhancesoft · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordesecforte.comesecforte.com
Sep 7, 2023A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL comCVE-2021-45811 · Other software · Enhancesoft · reported by MITREMedium 6.5
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmembers.backbox.orgmembers.backbox.org
Jun 14, 2023A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket CVE-2023-30082 · Other software · Enhancesoft · reported by MITREHigh 7.5
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.manavparekh.comgithub.com
Apr 5, 2023SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameterCVE-2022-31890 · Other software · Enhancesoft · reported by MITRECritical 9.8
SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function.
- Product
- Audit LOG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmarx.comgithub.com
Apr 5, 2023Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795CVE-2022-31889 · Other software · Enhancesoft · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae.
- Product
- Audit LOG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmarx.comgithub.com
Apr 5, 2023Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.CVE-2022-31888 · Other software · Enhancesoft · reported by MITREHigh 8.8
Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmarx.comgithub.com
Mar 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1320 · Other software · osticket · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1319 · Other software · osticket · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1318 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1317 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1316 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.CVE-2023-1315 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4.CVE-2022-4271 · Other software · osticket · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4.
- Product
- osticket/osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13debCVE-2022-32074 · Other software · Enhancesoft · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionalityCVE-2021-42235 · Other software · Enhancesoft · reported by MITRECritical 9.8
SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2021Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.CVE-2020-22609 · Other software · Enhancesoft · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2021Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.CVE-2020-22608 · Other software · Enhancesoft · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.CVE-2020-24881 · Other software · Enhancesoft · reported by MITRECritical 9.8
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblackbatsec.medium.com
Aug 30, 2020osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.CVE-2020-24917 · Other software · Enhancesoft · reported by MITREMedium 6.1
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2020osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.CVE-2020-16193 · Other software · Enhancesoft · reported by MITREMedium 5.4
osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2020scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description.CVE-2020-14012 · Other software · Enhancesoft · reported by MITREMedium 5.4
scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacker must be an Agent.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2020include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.CVE-2020-12629 · Other software · Enhancesoft · reported by MITREMedium 5.4
include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2019An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.CVE-2019-14750 · Other software · Enhancesoft · reported by MITREMedium 6.1
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 7, 2019An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.CVE-2019-14749 · Other software · Enhancesoft · reported by MITREHigh 8.8
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Calc, resulting in a situation where cells in the spreadsheets can contain input from an untrusted source. As a result, the end user who is accessing the exported spreadsheet can be affected.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 7, 2019An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.CVE-2019-14748 · Other software · Enhancesoft · reported by MITREMedium 5.4
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jul 9, 2019Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extCVE-2019-13397 · Other software · Enhancesoft · reported by MITREMedium 6.1
Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2019In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user CVE-2019-11537 · Other software · Enhancesoft · reported by MITREMedium 6.1
In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2018Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML CVE-2018-7196 · Other software · Enhancesoft · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Mar 27, 2018Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access CVE-2018-7195 · Other software · Enhancesoft · reported by MITREHigh 8.1
Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Mar 27, 2018Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventiCVE-2018-7194 · Other software · Enhancesoft · reported by MITREMedium 4.9
Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Mar 27, 2018Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HCVE-2018-7193 · Other software · Enhancesoft · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Mar 27, 2018Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web scriCVE-2018-7192 · Other software · Enhancesoft · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.securityevaluators.comblog.securityevaluators.com
Oct 23, 2017osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats.CVE-2017-15580 · Other software · Osticket · reported by MITRECritical 9.8
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day.todaynakedsecurity.com
Oct 15, 2017osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS.CVE-2017-15362 · Other software · Osticket · reported by MITREMedium 6.1
osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.
- Product
- Osticket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbecomepentester.blogspot.aebecomepentester.blogspot.ae
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.