osticket-stored-xss-security-assessment

CVE-2026-36214 - osTicket Stored XSS via Bootstrap Tooltip Consultant-Style Cybersecurity Report Professional vulnerability assessment report for osTicket stored cross-site scripting, including business impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details ---|--- Report...

CVE-2026-36214

CVE-2026-36214 - Stored Cross-Site Scripting XSS in osTicket via Vulnerable Bootstrap Tooltip Component Description Enhancesoft osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 ship with the known-vulnerable Bootstrap Tooltip 3.3.4 component CVE-2019-8331, which introduces a...

CVE-2019-8331

Eng Description CVE-2019-8331 is a Cross-Site Scripting XSS security vulnerability found in Bootstrap, a JavaScript library widely used for developing websites and mobile applications. This vulnerability occurs because Bootstrap does not properly sanitize data sent via thedata-template attribute ...

Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion

A directory traversal vulnerability in the JE Form Creator comjeformcr component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE -- the original researcher states that the...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Vulnearability Report of the New Jersey official site Bootstrap 4.0.0 Found in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Vulnerability info: Medium 28236 XSS in data-template, data-content and data-title properties of tooltip/popover...

CVE-2026-111676

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-111676

Faveo Helpdesk versions through 2.0.3 are vulnerable to a broken access control flaw in the getTooltip handler. Authenticated agents can exploit this by enumerating sequential ticketid values via a GET request to the /ticket/tooltip endpoint. This allows unauthorized access to ticket conversation...

CVE-2026-111676 Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

EUVD-2026-102967

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-96870

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-96870

The SureDash WordPress plugin (versions up to and including 1.12.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'display_name' parameter. The root cause is insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level access or higher ...

CVE-2026-96870 SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-102818

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-111676: Authorization Bypass Through User-Controlled Key

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-96870: Improper Neutralization of Input During Web Page Generation

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-116075

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

PT-2026-115528

Name of the Vulnerable Software and Affected Versions SureDash versions prior to 1.12.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into...

CVE-2026-106150

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker wi...

CVE-2026-106150

Progress Kendo UI for jQuery prior to version 2026.3.1015 is vulnerable to Cross-site Scripting (XSS) . The issue exists in the Splitter (starting with version 2011.2.804), Window (starting with version 2011.2.804), and Tooltip (starting with version 2013.1.319) components. The root cause is the ...

EUVD-2026-102077

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker wi...