CVE-2020-16193

2020-08-2612:15:13

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.5%

JSON

osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info[‘notes’] call.

CPENameOperatorVersion
osticketeq1.11
osticketeq1.12.4
osticketeq1.9.11
osticketeq1.9.12
osticketeq1.9.4-rc2
osticketeq1.8.0
osticketeq1.10-rc.2
osticketeq1.9.1
osticketeq1.10.5
osticketeq1.8.0.2

Name	Operator	Version
osticket	eq	1.11
osticket	eq	1.12.4
osticket	eq	1.9.11
osticket	eq	1.9.12
osticket	eq	1.9.4-rc2
osticket	eq	1.8.0
osticket	eq	1.10-rc.2
osticket	eq	1.9.1
osticket	eq	1.10.5
osticket	eq	1.8.0.2