CVE-2026-14871

CVE-2026-14871 - BOLA / IDOR in osTicket ajax.tickets.php Broken Object Level Authorization BOLA: Insecure Direct Object Reference IDOR include/ajax.tickets.php → viewField function Reported by @JF0x0r · March 27, 2026 Status: PATCHED - Fix released in osTicket v1.17.8 / v1.18.4 At a Glance...

cve-disclosures

CVE Disclosures Coordinated vulnerability disclosures and CVE references published by Anindya Sankar Roy GitHub: @fr3akhacks. Each entry below links to a public advisory containing the affected product, affected/fixed versions, CVE ID, prose description, vulnerability type, root cause, and impact...

CVE-2022-32074

CVE-2022-32074 for osTicket | Support Ticketing System root@kitploit: 1. Find the file listing directory, the root of the file download directoryм fileuploads this is an example. 2. Load the following xssPayload.svg and open it Example:...

CVE-2026-22200

CVE-2026-22200: osTicket PDF File Read + CNEXT RCE Proof of concept exploit for osTicket CVE-2026-22200 which abuses PHP filters to exfiltrate files through the mPDF library and can be chained to RCE via CVE-2024-2961 CNEXT. Blog Post Deep-dive here: Horizon3.ai - Ticket to Shell: Exploiting PHP...

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

osTicket < v1.16.6 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prior to v1.16.6. id: CVE-2023-1317 info: name: osTicket v1.16.6 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prio...

osTicket 1.15.x - SQL Injection

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topicid" URL parameters combination. id: CVE-2021-45811 info: name: osTicket 1.15.x - SQL Injection author:...

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. id: CVE-2018-7196 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter. id: CVE-2018-7192 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity:...

osTicket < v1.16.6 - Cross-Site Scripting

Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to v1.16.6. id: CVE-2023-1318 info: name: osTicket v1.16.6 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to...

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter. id: CVE-2018-7193 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

OsTicket < 1.14.3 - Server Side Request Forgery

SSRF vulnerability exists in osTicket before 1.14.3, allowing an attacker to add malicious files to the server or perform port scanning. id: CVE-2020-24881 info: name: OsTicket 1.14.3 - Server Side Request Forgery author: hnd3884 severity: critical description: | SSRF vulnerability exists in...

osTicket - Arbitrary File Read

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...

osTicket < v1.16.6 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prior to v1.16.6. id: CVE-2023-1315 info: name: osTicket v1.16.6 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prio...

CVE-2022-31889

CVE-2022-31889 for osTicket | Support Ticketing System Reflected XSS root@kitploit: http://localhost/scp/audits.php?startData=&endDate=&type="alert'reflectedXSS'...

CVE-2022-32132

CVE-2022-32132 for osTicket | Support Ticketing System Reflected XSS: root@kitploit: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...

CVE-2022-31890

CVE-2022-31890 for osTicket | Support Ticketing System Nickname: root@kitploit: python nickname.py The output of the first nickname in the table. Password: root@kitploit: python password.py The output of the first password in the table. Output to file: root@kitploit: python dumpFile.py cat dump.t...

osTicketFileReadIntoRCE

CVE-2026-22200: osTicket Arbitrary File Read to RCE Full-chain exploit combining PHP filter chain injection with CVE-2024-2961 CNEXT for unauthenticated Remote Code Execution on vulnerable osTicket installations. Table of Contents Overview Vulnerability Details Attack Flow Features Installation...

osticket-stored-xss-security-assessment

CVE-2026-36214 - osTicket Stored XSS via Bootstrap Tooltip Consultant-Style Cybersecurity Report Professional vulnerability assessment report for osTicket stored cross-site scripting, including business impact, remediation, and mitigation strategy. 📍 Report Snapshot...

CVE-2026-36214

CVE-2026-36214 - Stored Cross-Site Scripting XSS in osTicket via Vulnerable Bootstrap Tooltip Component Description Enhancesoft osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 ship with the known-vulnerable Bootstrap Tooltip 3.3.4 component CVE-2019-8331, which introduces a...