CVE-2022-25802

CVE-2022-25802 details: Best Practical Request Tracker (RT) is vulnerable to a cross-site scripting (XSS) flaw when displaying an attachment, exploitable via a crafted content type. Affected versions are RT 4.4.0–4.4.6 and RT 5.x prior to 5.0.3. Public sources indicate upstream fixes/patches have...

CVE-2023-41259

CVE-2023-41259 affects Best Practical Request Tracker (RT) prior to 4.4.7 and RT 5.x prior to 5.0.5, allowing Information Disclosure via fake or spoofed RT email headers in an email message or in the mail-gateway REST API call. The underlying issue is unvalidated email headers accepted by RT, ena...

CVE-2023-41260

CVE-2023-41260 affects Best Practical Request Tracker (RT) prior to 4.4.7 and RT 5.x prior to 5.0.5, enabling information exposure in responses to mail-gateway REST API calls. Public references indicate fixes in RT 4.4.7 and RT 5.0.5, with Debian LTS patching RT 4.4.3-2+deb10u3. No exploitation d...

CVE-2022-25803

The CVE-2022-25803 entry concerns Best Practical Request Tracker (RT) before 5.0.3, which is vulnerable to an Open Redirect via a ticket search. Public references note the issue as part of RT’s release notes for 5.0.3, indicating an in-product redirect vulnerability rather than a broader exploita...

CVE-2026-44231

CVE-2026-44231 affects RT REST 2.0: a privileged (non-administrative) user can obtain authentication credentials belonging to other users (including admins) and use them to read data via RT’s feed endpoints. The same request that exposes credentials also rotates them, invalidating existing feed U...