{"id":"CVE-2021-45811","aliases":["EUVD-2021-32529","GHSA-h3wq-7fh4-v9c2"],"status":"published","title":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1...","description":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the \"keywords\" and \"topic_id\" URL parameters combination.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02496,"percentile":0.8489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2023-09-08T00:00:00Z","modified":"2026-10-24T10:31:06Z","exploits":[{"source":"nuclei","id":"CVE-2021-45811","title":"osTicket 1.15.x - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45811.yaml"}],"products":[{"vendor":"enhancesoft","product":"osticket"}],"references":[{"url":"https://members.backbox.org/osticket-sql-injection/","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45811"},{"url":"http://enhancesoft.com"},{"url":"http://osticket.com"},{"url":"https://members.backbox.org/osticket-sql-injection"},{"url":"https://github.com/advisories/GHSA-h3wq-7fh4-v9c2"}],"sources":{"cve":[{"id":"CVE-2021-45811","description":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the \"keywords\" and \"topic_id\" URL parameters combination.","status":"published","published":"2023-09-08T00:00:00Z","modified":"2026-07-09T00:16:19.065Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2021-32529","description":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the \"keywords\" and \"topic_id\" URL parameters combination.","status":"published","published":"2023-09-08T00:00:00Z","modified":"2026-07-09T00:16:19Z","updated_at":"2026-11-02T18:20:08.115071Z"}],"ghsa":[{"id":"GHSA-h3wq-7fh4-v9c2","title":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1...","description":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the \"keywords\" and \"topic_id\" URL parameters combination.","status":"published","published":"2023-09-08T03:30:20Z","modified":"2024-04-04T07:33:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:56:52.639328Z"}],"nvd":[{"id":"CVE-2021-45811","description":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the \"keywords\" and \"topic_id\" URL parameters combination.","status":"published","published":"2023-09-08T02:15:07.877Z","modified":"2026-07-09T01:17:12.03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"CVE-2021-45811","description":"A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the \"keywords\" and \"topic_id\" URL parameters combination.","status":"published","published":"2023-09-08T02:15:07.877Z","modified":"2026-10-24T10:31:06.089611862Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:22.18434Z"}]}}