{"id":"CVE-2016-5843","aliases":["ALPINE-CVE-2016-5843","EUVD-2016-6778","GHSA-9gq7-7qp9-2c82"],"status":"published","title":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and...","description":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.","severity":{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03209,"percentile":0.88253,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2016-09-17T01:00:00Z","modified":"2026-09-22T06:30:25Z","fixes":[{"ecosystem":"Alpine:v3.4","package":"gst-plugins-bad1","fixed_in":["1.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"gst-plugins-bad1","fixed_in":["1.8.3-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.4","package":"gst-plugins-bad1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"gst-plugins-bad1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-r0"}]}]}],"products":[{"vendor":"otrs","product":"faq"}],"references":[{"url":"https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/93019","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5843"},{"url":"https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package"},{"url":"https://github.com/advisories/GHSA-9gq7-7qp9-2c82"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-5843","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-5843","description":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.","status":"published","published":"2016-09-17T01:00:00Z","modified":"2024-08-06T01:15:10.79Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6778","description":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.","status":"published","published":"2016-09-17T01:00:00Z","modified":"2024-08-06T01:15:10Z","updated_at":"2026-11-03T02:22:41.580609Z"}],"ghsa":[{"id":"GHSA-9gq7-7qp9-2c82","title":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and...","description":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.","status":"published","published":"2022-05-17T03:40:12Z","modified":"2025-04-12T13:05:16Z","cvss":[{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:01:29.780856Z"}],"nvd":[{"id":"CVE-2016-5843","description":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.","status":"published","published":"2016-09-17T02:59:00.147Z","modified":"2026-06-17T00:50:07.923Z","cvss":[{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:N/C:C/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"ALPINE-CVE-2016-5843","description":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.","status":"published","published":"2016-09-17T02:59:00.147Z","modified":"2026-09-22T06:30:25.124924178Z","cvss":[{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-5843","description":"Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.","status":"published","published":"2016-09-17T02:59:00.147Z","modified":"2026-03-14T09:21:10.203064Z","cvss":[{"version":"3.0","score":9.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:44:02.776224Z"}]}}