Otrs Ag vulnerabilities

Products

• Otrs 84
• ((otrs)) Community Edition 52
• Otrscisincustomerfrontend 2

Newest

• otrs ag ((otrs)) community edition, otrs gmbh (former otrs ag) otrs +1 more Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication CVE-2026-93582 9.4 CriticalOctober 12, 2026
• otrs ag ((otrs)) community edition, otrs +1 more Insufficient Neutralization of Formula Elements in CSV Exports CVE-2026-93581 6.1 MediumOctober 12, 2026
• otrs ag ((otrs)) community edition, otrs +1 more Duplicate Identity / Identity Shadowing across CustomerUser backends CVE-2026-78359 5.4 MediumOctober 12, 2026
• otrs ag ((otrs)) community edition, otrs +1 more Cross-Site Request Forgery in Administrative Actions CVE-2026-78358 4.3 MediumOctober 12, 2026
• otrs ag otrs Insufficient Session Revocation for JWT Authentication CVE-2026-78357 9.1 CriticalOctober 12, 2026
• otrs ag otrs Unauthenticated Disclosure of Agent Frontend Configuration CVE-2026-78356 5.3 MediumOctober 12, 2026
• otrs ag ((otrs)) community edition, otrs +1 more Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory CVE-2026-78355 8.7 HighOctober 12, 2026
• otrs ag otrs Stored XSS in external pages CVE-2026-48212 4.8 MediumOctober 12, 2026
• otrs ag ((otrs)) community edition, otrs +1 more Cross-Site Request Forgery in Import/Export Admin console CVE-2026-48211 5.4 MediumOctober 12, 2026
• otrs, otrs ag ((otrs)) community edition +1 more Email with special content can lead to DoS CVE-2026-48187 5.7 MediumJune 1, 2026
• otrs, otrs ag ((otrs)) community edition +1 more SQL Injection via MySQL Quote Method CVE-2026-48188 Public exploitFix available 9.1 CriticalJune 1, 2026
• otrs Bypass DedicatedAgentToCustomerGroups Setting CVE-2026-48189 5.7 MediumJune 1, 2026
• otrs Incorrect handling of permissions in External Interface Config Item List module CVE-2026-48190 3.5 LowJune 1, 2026
• otrs Wrong Permission Handling in Document Search Article Meta Filters CVE-2026-48191 3.5 LowJune 1, 2026
• otrs, otrs ag ((otrs)) community edition +1 more Denial-of-Service via SVG Rendering in Ticket CVE-2026-48208 Public exploit 6.5 MediumJune 1, 2026
• otrs, otrs ag ((otrs)) community edition +1 more Reflected XSS in authenticated agent context CVE-2026-48209 7.1 HighJune 1, 2026
• otrs Possible information disclosure via External Interface CVE-2026-48210 5.7 MediumMay 31, 2026
• otrs ag otrs Possible DoS via SQL Box CVE-2026-6060 Public exploit 4.5 MediumApril 20, 2026
• otrs ag otrs Possible user enumeration CVE-2025-24391 5.3 MediumJuly 14, 2025
• otrs ag ((otrs)) community edition, otrs +1 more Unsafe handling of AJAX calls CVE-2025-24388 3.8 LowJune 16, 2025
• otrs Missing CSRF protection CVE-2025-24387 4.8 MediumMarch 10, 2025
• otrs ag otrs Missing Cookie Flags CVE-2025-24390 6.8 MediumJanuary 27, 2025
• otrs ag ((otrs)) community edition, otrs +1 more SMTP Password will be shown in cleartext on some SMTP errors CVE-2025-24389 6.3 MediumJanuary 27, 2025
• otrs ag ((otrs)) community edition, otrs +1 more Improper check of permissions in Generic Interface CVE-2024-43446 3.5 LowJanuary 27, 2025
• otrs ag ((otrs)) community edition, otrs +1 more Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing CVE-2024-43445 5.4 MediumJanuary 27, 2025
• otrs, otrs ag ((otrs)) community edition +1 more Passwords are written to Admin Log Module CVE-2024-43444 8.2 HighAugust 26, 2024
• otrs ag ((otrs)) community edition, otrs +1 more Stored XSS in process management CVE-2024-43443 4.9 MediumAugust 26, 2024
• otrs ag ((otrs)) community edition, otrs +1 more Stored XSS in System Configuration CVE-2024-43442 4.9 MediumAugust 26, 2024
• otrs Agents are able to lock the ticket without the "Owner" permission CVE-2024-23794 5.2 MediumJuly 15, 2024
• otrs Information exlosure in external interface CVE-2024-6540 5.7 MediumJuly 15, 2024
• otrs, otrs community edition, otrs ag ((otrs)) community edition +2 more Upload of files outside application directory CVE-2024-23793 6.3 MediumJune 6, 2024
• otrs Missing file type check in avatar picture upload CVE-2024-23790 3.5 LowJanuary 29, 2024
• otrs Unnecessary data is written to log if issues during indexing occurs CVE-2024-23791 4.9 MediumJanuary 29, 2024
• otrs Insufficient access control CVE-2024-23792 5.3 MediumJanuary 29, 2024
• otrs Password is send back to client CVE-2023-6254 8.1 HighNovember 27, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Possible XSS execution in customer information CVE-2023-5421 3.5 LowOctober 16, 2023
• otrs, otrs ag ((otrs)) community edition +1 more External pictures can be loaded even if not allowed by configuration CVE-2023-38059 5.3 MediumOctober 16, 2023
• otrs, otrs ag ((otrs)) community edition, otrs community edition community edition +2 more SSL Certificates are not checked for E-Mail Handling CVE-2023-5422 8.7 HighOctober 16, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Host header injection by attachments in web service CVE-2023-38060 Fix available 6.3 MediumJuly 24, 2023
• otrs Tickets can be moved without permissions CVE-2023-38058 4.1 MediumJuly 24, 2023
• otrs survey, otrs ag ((otrs)) community edition, otrs +2 more XSS stored in survey answers CVE-2023-38057 4.1 MediumJuly 24, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Code execution via System Configuration CVE-2023-38056 7.2 HighJuly 24, 2023
• otrs Information disclouse and DoS via websocket push events CVE-2023-2534 7.6 HighMay 8, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Code execution through ACL creation CVE-2023-1250 7.4 HighMarch 20, 2023
• otrs, otrs ag ((otrs)) community edition +1 more Possible XSS in Ticket Actions CVE-2023-1248 6.1 MediumMarch 20, 2023
• otrs, otrs ag ((otrs)) community edition +1 more SQL Injection via OTRS Search API CVE-2022-4427 Fix available 6.5 MediumDecember 19, 2022
• accessing template content without permissions otrs Information exposure of template content due to missing check of permissions CVE-2022-3501 3.5 LowOctober 17, 2022
• otrs, otrs ag ((otrs)) community edition +1 more DoS attack using email CVE-2022-39052 7.5 HighOctober 17, 2022
• otrs, otrs ag ((otrs)) community edition +1 more Perl Code execution in Template Toolkit CVE-2022-39051 6.8 MediumSeptember 5, 2022
• otrs, otrs ag ((otrs)) community edition +1 more Possible XSS stored in customer information CVE-2022-39050 4.6 MediumSeptember 5, 2022
• Show olderLoading…