Skip to contentOtrs Ag ((otrs)) Community Edition vulnerabilities
- otrs ag ((otrs)) community edition, otrs gmbh (former otrs ag) otrs +1 moreAuthentication Bypass via Spoofed Remote-User Header in HTTP Basic AuthenticationCVE-2026-935829.4 Critical
- otrs ag ((otrs)) community edition, otrs +1 moreInsufficient Neutralization of Formula Elements in CSV ExportsCVE-2026-935816.1 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreDuplicate Identity / Identity Shadowing across CustomerUser backendsCVE-2026-783595.4 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreCross-Site Request Forgery in Administrative ActionsCVE-2026-783584.3 Medium
- otrs ag ((otrs)) community edition, otrs +1 morePath Traversal in SendSupportBundle allows File Deletion Outside the Intended DirectoryCVE-2026-783558.7 High
- otrs ag ((otrs)) community edition, otrs +1 moreCross-Site Request Forgery in Import/Export Admin consoleCVE-2026-482115.4 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreEmail with special content can lead to DoSCVE-2026-481875.7 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSQL Injection via MySQL Quote MethodCVE-2026-48188Public exploitFix available9.1 Critical
- otrs, otrs ag ((otrs)) community edition +1 moreDenial-of-Service via SVG Rendering in TicketCVE-2026-48208Public exploit6.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreReflected XSS in authenticated agent contextCVE-2026-482097.1 High
- otrs ag ((otrs)) community edition, otrs +1 moreUnsafe handling of AJAX callsCVE-2025-243883.8 Low
- otrs ag ((otrs)) community edition, otrs +1 moreSMTP Password will be shown in cleartext on some SMTP errorsCVE-2025-243896.3 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreImproper check of permissions in Generic InterfaceCVE-2024-434463.5 Low
- otrs ag ((otrs)) community edition, otrs +1 moreMissing X-Content-Type-Options: nosniff Header Allows MIME Type SniffingCVE-2024-434455.4 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePasswords are written to Admin Log ModuleCVE-2024-434448.2 High
- otrs ag ((otrs)) community edition, otrs +1 moreStored XSS in process managementCVE-2024-434434.9 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreStored XSS in System ConfigurationCVE-2024-434424.9 Medium
- otrs, otrs community edition, otrs ag ((otrs)) community edition +2 moreUpload of files outside application directoryCVE-2024-237936.3 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS execution in customer informationCVE-2023-54213.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreExternal pictures can be loaded even if not allowed by configurationCVE-2023-380595.3 Medium
- otrs, otrs ag ((otrs)) community edition, otrs community edition community edition +2 moreSSL Certificates are not checked for E-Mail HandlingCVE-2023-54228.7 High
- otrs, otrs ag ((otrs)) community edition +1 moreHost header injection by attachments in web serviceCVE-2023-38060Fix available6.3 Medium
- otrs survey, otrs ag ((otrs)) community edition, otrs +2 moreXSS stored in survey answersCVE-2023-380574.1 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreCode execution via System ConfigurationCVE-2023-380567.2 High
- otrs, otrs ag ((otrs)) community edition +1 moreCode execution through ACL creationCVE-2023-12507.4 High
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS in Ticket ActionsCVE-2023-12486.1 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSQL Injection via OTRS Search APICVE-2022-4427Fix available6.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreDoS attack using emailCVE-2022-390527.5 High
- otrs, otrs ag ((otrs)) community edition +1 morePerl Code execution in Template ToolkitCVE-2022-390516.8 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS stored in customer informationCVE-2022-390504.6 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS in Admin InterfaceCVE-2022-390493.5 Low
- otrs, otrs itsm, storm +3 more +5 moreAuthenticated remote code executionCVE-2021-361006.4 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSupport Bundle includes S/Mime and PGP secret or PINCVE-2021-360965.2 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreUser enumeration issue using "lost password" featureCVE-2021-360955.3 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreXSS attack in appointment edit popup screenCVE-2021-360945.7 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreDoS attack using PostMaster filtersCVE-2021-360935.3 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreXSS attack using special link in emailCVE-2021-360926.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreUnautorized access to the calendar appointmentsCVE-2021-36091Fix available3.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreUnautorized listing of the customer user emailsCVE-2021-21443Fix available3.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreSupport Bundle includes S/Mime and PGP keysCVE-2021-21440Fix available5.2 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreXSS in the ticket overview screensCVE-2021-21441Fix available7.5 High
- otrs, otrs ag ((otrs)) community edition +1 morePossible DoS attack using a special crafted URL in email bodyCVE-2021-21439Fix available6.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreInvalidating or changing user does not invalidate sessionCVE-2020-1776Fix available3.5 Low
- otrs, otrs ag ((otrs)) community edition, debian linux +2 moreInformation disclosureCVE-2020-1774Fix available4.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSession / Password / Password token leakCVE-2020-1773Fix available7.3 High
- otrs, otrs ag ((otrs)) community edition, debian linux +2 more +4 moreInformation DisclosureCVE-2020-1772Fix available6.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS in Customer user address bookCVE-2020-1771Fix available4.6 Medium
- otrs, otrs ag ((otrs)) community edition, debian linux +2 more +4 moreInformation disclosure in support bundle filesCVE-2020-1770Fix available2.4 Low
- otrs, otrs ag ((otrs)) community edition, opensuse backports sle +1 more +3 moreAutocomplete in the form login screensCVE-2020-1769Fix available3.5 Low
- otrs, otrs ag ((otrs)) community edition, debian linux +2 morePossible to send drafted messages as wrong agentCVE-2020-1767Fix available3.5 Low
- Show moreLoading…