Osticket

Osticket

31 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2026-26895

Exploit
  • EPSS 0.05%
  • Veröffentlicht 02.04.2026 00:00:00
  • Zuletzt bearbeitet 07.04.2026 16:01:01

User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.

5.4

CVE-2025-45387

  • EPSS 0.13%
  • Veröffentlicht 02.06.2025 00:00:00
  • Zuletzt bearbeitet 05.06.2025 14:11:24

osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.

6.5

CVE-2025-26241

Exploit
  • EPSS 0.25%
  • Veröffentlicht 05.05.2025 00:00:00
  • Zuletzt bearbeitet 13.06.2025 18:38:51

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.

5.4

CVE-2022-32074

  • EPSS 0.98%
  • Veröffentlicht 13.07.2022 16:15:08
  • Zuletzt bearbeitet 21.11.2024 07:05:44

A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted S...

9.8

CVE-2020-24881

Exploit
  • EPSS 91.34%
  • Veröffentlicht 02.11.2020 21:15:26
  • Zuletzt bearbeitet 21.11.2024 05:16:09

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.

6.1

CVE-2020-24917

  • EPSS 0.31%
  • Veröffentlicht 30.08.2020 16:15:14
  • Zuletzt bearbeitet 21.11.2024 05:16:12

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.

5.4

CVE-2020-16193

  • EPSS 0.21%
  • Veröffentlicht 26.08.2020 12:15:13
  • Zuletzt bearbeitet 21.11.2024 05:06:54

osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.

6.1

CVE-2019-14750

  • EPSS 3.83%
  • Veröffentlicht 07.08.2019 17:15:12
  • Zuletzt bearbeitet 21.11.2024 04:27:16

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of mali...

8.8

CVE-2019-14749

  • EPSS 14.77%
  • Veröffentlicht 07.08.2019 17:15:12
  • Zuletzt bearbeitet 21.11.2024 04:27:15

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Nam...

5.4

CVE-2019-14748

Exploit
  • EPSS 0.44%
  • Veröffentlicht 07.08.2019 17:15:12
  • Zuletzt bearbeitet 21.11.2024 04:27:15

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file c...