EUVD-2026-102967

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-11875

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner identified by email address to read, reply to, and close that person's support tickets...

PT-2025-47727

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions through 3.2.9 Description The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress has an Insecure Direct Object Reference issue. This is due to a lack of...

DEBIAN-CVE-2009-5056

Open Ticket Request System OTRS before 2.4.0-beta2 does not properly enforce the moveinto permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-ticket...

PT-2011-1317

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 2.4.0-beta2 Description The issue allows remote authenticated users to bypass intended access restrictions. This is due to the improper enforcement of the move into permission setting for a...