Osticket vulnerabilities

Products

• Osticket 10
• Osticket/osticket 7
• Sts 5

Newest

• osticket osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure CVE-2026-14871 Public exploit 7.1 HighJuly 17, 2026
• osticket osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored... CVE-2026-36214 Public exploit 6.4 MediumJuly 14, 2026
• osticket osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in ... CVE-2025-45387 5.4 MediumJune 2, 2025
• enhancesoft osticket, osticket osticket/osticket +1 more Cross-site Scripting (XSS) - Stored in osticket/osticket CVE-2023-1320 7.1 HighMarch 10, 2023
• enhancesoft osticket, osticket osticket/osticket +1 more Cross-site Scripting (XSS) - Stored in osticket/osticket CVE-2023-1319 4.8 MediumMarch 10, 2023
• enhancesoft osticket, osticket osticket/osticket +1 more Cross-site Scripting (XSS) - Generic in osticket/osticket CVE-2023-1318 5.4 MediumMarch 10, 2023
• enhancesoft osticket, osticket osticket/osticket +1 more Cross-site Scripting (XSS) - Reflected in osticket/osticket CVE-2023-1317 5.4 MediumMarch 10, 2023
• enhancesoft osticket, osticket osticket/osticket +1 more Cross-site Scripting (XSS) - Stored in osticket/osticket CVE-2023-1316 4.5 MediumMarch 10, 2023
• enhancesoft osticket, osticket osticket/osticket +1 more Cross-site Scripting (XSS) - Reflected in osticket/osticket CVE-2023-1315 5.4 MediumMarch 10, 2023
• enhancesoft osticket, osticket osticket/osticket +1 more Cross-site Scripting (XSS) - Reflected in osticket/osticket CVE-2022-4271 8.0 HighDecember 2, 2022
• osticket osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However,... CVE-2017-15580 Public exploit EPSS 15.6% 9.8 CriticalOctober 23, 2017
• osticket osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a... CVE-2017-15362 6.1 MediumOctober 16, 2017
• osticket In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square... CVE-2017-14396 Public exploit 9.8 CriticalSeptember 12, 2017
• enhancesoft osticket Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows... CVE-2010-0606 3.5 LowFebruary 11, 2010
• enhancesoft osticket SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote... CVE-2010-0605 Public exploit 7.5 HighFebruary 11, 2010
• osticket sts Cross-site scripting (XSS) vulnerability in support/view.php in Support Cards 1 (osTicket) allows... CVE-2006-6733 Public exploit 4.3 MediumDecember 26, 2006
• osticket sts PHP local file inclusion vulnerability in (1) view.php and (2) open.php in osTicket 1.3.1 beta... CVE-2005-2154 Public exploit 7.5 HighJuly 6, 2005
• osticket sts SQL injection vulnerability in class.ticket.php in osTicket 1.3.1 beta and earlier allows remote... CVE-2005-2153 7.5 HighJuly 6, 2005
• osticket PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers to... CVE-2005-1438 7.5 HighMay 3, 2005
• osticket Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute arbitrary... CVE-2005-1437 7.5 HighMay 3, 2005
• osticket sts osTicket trusts a hidden form field in the submit form to limit the upload size of a document,... CVE-2004-0614 6.4 MediumJune 30, 2004
• osticket sts osTicket allows remote attackers to view sensitive uploaded files and possibly execute arbitrary... CVE-2004-0613 Public exploit 7.5 HighJune 30, 2004