658 matches found
PT-2025-23544 · Osticket · Osticket
Name of the Vulnerable Software and Affected Versions: osTicket versions prior to 1.17.6 and prior to 1.18.2 Description: The issue is related to a Broken Access Control Vulnerability in the /scp/ajax.php endpoint. This vulnerability affects osTicket versions prior to 1.17.6 and prior to 1.18.2...
CVE-2024-21728
An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky osTicket Bridge by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return paramete...
CVE-2023-46967
Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket...
CVE-2023-27149
A stored cross-site scripting XSS vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list...
CVE-2023-1319
Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-1317
Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-1316
Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-1318
Cross-site Scripting XSS - Generic in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-1315
Cross-site Scripting XSS - Reflected in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-30082
A denial of service attack might be launched against the server if an unusually lengthy password more than 10000000 characters is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all...
CVE-2023-1320
Cross-site Scripting XSS - Stored in GitHub repository osticket/osticket prior to v1.16.6...
CVE-2023-27148
A stored cross-site scripting XSS vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter...
CVE-2022-32074
A stored cross-site scripting XSS vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file...
CVE-2021-45811
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topicid" URL parameters combination...
CVE-2020-24881
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning...
CVE-2020-22609
Cross Site Scripting XSS vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php...
CVE-2020-24917
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::uploadInlineImage in include/ajax.draft.php...
CVE-2020-12629
include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name...