Otrs vulnerabilities

Products

• Otrs 144
• Itsm 8
• Open Ticket Request System 6
• Faq 4
• Help Desk 2
• Survey 2

Newest

• otrs, otrs ag ((otrs)) community edition +1 more Email with special content can lead to DoS CVE-2026-48187 5.7 MediumJune 1, 2026
• otrs, otrs ag ((otrs)) community edition +1 more SQL Injection via MySQL Quote Method CVE-2026-48188 Public exploitFix available 9.1 CriticalJune 1, 2026
• otrs Bypass DedicatedAgentToCustomerGroups Setting CVE-2026-48189 5.7 MediumJune 1, 2026
• otrs Incorrect handling of permissions in External Interface Config Item List module CVE-2026-48190 3.5 LowJune 1, 2026
• otrs Wrong Permission Handling in Document Search Article Meta Filters CVE-2026-48191 3.5 LowJune 1, 2026
• otrs, otrs ag ((otrs)) community edition +1 more Denial-of-Service via SVG Rendering in Ticket CVE-2026-48208 Public exploit 6.5 MediumJune 1, 2026
• otrs, otrs ag ((otrs)) community edition +1 more Reflected XSS in authenticated agent context CVE-2026-48209 7.1 HighJune 1, 2026
• otrs Possible information disclosure via External Interface CVE-2026-48210 5.7 MediumMay 31, 2026
• otrs Missing CSRF protection CVE-2025-24387 4.8 MediumMarch 10, 2025
• otrs, otrs ag ((otrs)) community edition +1 more Passwords are written to Admin Log Module CVE-2024-43444 8.2 HighAugust 26, 2024
• otrs Agents are able to lock the ticket without the "Owner" permission CVE-2024-23794 5.2 MediumJuly 15, 2024
• otrs Information exlosure in external interface CVE-2024-6540 5.7 MediumJuly 15, 2024
• otrs, otrs community edition, otrs ag ((otrs)) community edition +2 more Upload of files outside application directory CVE-2024-23793 6.3 MediumJune 6, 2024
• otrs Missing file type check in avatar picture upload CVE-2024-23790 3.5 LowJanuary 29, 2024
• otrs Unnecessary data is written to log if issues during indexing occurs CVE-2024-23791 4.9 MediumJanuary 29, 2024
• otrs Insufficient access control CVE-2024-23792 5.3 MediumJanuary 29, 2024
• otrs Password is send back to client CVE-2023-6254 8.1 HighNovember 27, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Possible XSS execution in customer information CVE-2023-5421 3.5 LowOctober 16, 2023
• otrs, otrs ag ((otrs)) community edition +1 more External pictures can be loaded even if not allowed by configuration CVE-2023-38059 5.3 MediumOctober 16, 2023
• otrs, otrs ag ((otrs)) community edition, otrs community edition community edition +2 more SSL Certificates are not checked for E-Mail Handling CVE-2023-5422 8.7 HighOctober 16, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Host header injection by attachments in web service CVE-2023-38060 Fix available 6.3 MediumJuly 24, 2023
• otrs Tickets can be moved without permissions CVE-2023-38058 4.1 MediumJuly 24, 2023
• otrs survey, otrs ag ((otrs)) community edition, otrs +2 more XSS stored in survey answers CVE-2023-38057 4.1 MediumJuly 24, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Code execution via System Configuration CVE-2023-38056 7.2 HighJuly 24, 2023
• otrs Information disclouse and DoS via websocket push events CVE-2023-2534 7.6 HighMay 8, 2023
• otrs An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker... CVE-2018-17883 Fix available 6.1 MediumApril 15, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Code execution through ACL creation CVE-2023-1250 7.4 HighMarch 20, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Possible XSS in Ticket Actions CVE-2023-1248 6.1 MediumMarch 20, 2023
• otrs, otrs ag ((otrs)) community edition +1 more SQL Injection via OTRS Search API CVE-2022-4427 Fix available 6.5 MediumDecember 19, 2022
• accessing template content without permissions otrs Information exposure of template content due to missing check of permissions CVE-2022-3501 3.5 LowOctober 17, 2022
• otrs, otrs ag ((otrs)) community edition +1 more DoS attack using email CVE-2022-39052 7.5 HighOctober 17, 2022
• otrs, otrs ag ((otrs)) community edition +1 more Perl Code execution in Template Toolkit CVE-2022-39051 6.8 MediumSeptember 5, 2022
• otrs, otrs ag ((otrs)) community edition +1 more Possible XSS stored in customer information CVE-2022-39050 4.6 MediumSeptember 5, 2022
• otrs, otrs ag ((otrs)) community edition +1 more Possible XSS in Admin Interface CVE-2022-39049 3.5 LowSeptember 5, 2022
• otrs Information disclosure in Request New Password feature CVE-2022-32741 5.3 MediumJune 13, 2022
• otrs Information disclosure in the External Interface CVE-2022-32740 3.5 LowJune 13, 2022
• otrs, otrs calendar resource planning, otrs ag otrscalendarresourceplanning +2 more OTRS version number is always in the exported ICS files CVE-2022-32739 3.5 LowJune 13, 2022
• otrs Information disclosure in the External Interface CVE-2022-1004 4.3 MediumMarch 21, 2022
• otrs Possible XSS attack via translation CVE-2022-0475 3.5 LowMarch 21, 2022
• otrs, otrs itsm, storm +3 more +5 more Authenticated remote code execution CVE-2021-36100 6.4 MediumMarch 21, 2022
• otrs ag otrscustomcontactfields, otrs custom contact fields +1 more Disclosure of mail addresses CVE-2022-0474 2.4 LowFebruary 7, 2022
• otrs Dynamic field error message is vulnerable to XSS CVE-2022-0473 3.8 LowFebruary 7, 2022
• otrs Agents are able to lock the ticket without the "Owner" permission CVE-2021-36097 3.5 LowOctober 18, 2021
• otrs, otrs ag ((otrs)) community edition +1 more Support Bundle includes S/Mime and PGP secret or PIN CVE-2021-36096 5.2 MediumSeptember 6, 2021
• otrs, otrs ag ((otrs)) community edition +1 more User enumeration issue using "lost password" feature CVE-2021-36095 5.3 MediumSeptember 6, 2021
• otrs, otrs ag ((otrs)) community edition +1 more XSS attack in appointment edit popup screen CVE-2021-36094 5.7 MediumSeptember 6, 2021
• otrs, otrs ag ((otrs)) community edition +1 more DoS attack using PostMaster filters CVE-2021-36093 5.3 MediumSeptember 6, 2021
• otrs, otrs itsm +1 more Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3... CVE-2013-4718 5.4 MediumAugust 9, 2021
• otrs, otrs ag ((otrs)) community edition +1 more XSS attack using special link in email CVE-2021-36092 6.5 MediumJuly 26, 2021
• otrs, otrs ag ((otrs)) community edition +1 more Unautorized access to the calendar appointments CVE-2021-36091 Fix available 3.5 LowJuly 26, 2021
• Show olderLoading…