CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability exists because the From-header display name in email replies is extracted without sanitization in include/class.mailparse.php and stored raw in...

WordPress KB Support plugin <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure vulnerability

Missing Authorization to Unauthenticated Ticket Reply Exposure vulnerability discovered by Krzysztof Zając in WordPress Plugin KB Support versions = 1.6.6...