Skip to contentOtrs Ag Otrs vulnerabilities
- otrs ag ((otrs)) community edition, otrs gmbh (former otrs ag) otrs +1 moreAuthentication Bypass via Spoofed Remote-User Header in HTTP Basic AuthenticationCVE-2026-935829.4 Critical
- otrs ag ((otrs)) community edition, otrs +1 moreInsufficient Neutralization of Formula Elements in CSV ExportsCVE-2026-935816.1 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreDuplicate Identity / Identity Shadowing across CustomerUser backendsCVE-2026-783595.4 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreCross-Site Request Forgery in Administrative ActionsCVE-2026-783584.3 Medium
- otrs ag otrsInsufficient Session Revocation for JWT AuthenticationCVE-2026-783579.1 Critical
- otrs ag otrsUnauthenticated Disclosure of Agent Frontend ConfigurationCVE-2026-783565.3 Medium
- otrs ag ((otrs)) community edition, otrs +1 morePath Traversal in SendSupportBundle allows File Deletion Outside the Intended DirectoryCVE-2026-783558.7 High
- otrs ag otrsStored XSS in external pagesCVE-2026-482124.8 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreCross-Site Request Forgery in Import/Export Admin consoleCVE-2026-482115.4 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreEmail with special content can lead to DoSCVE-2026-481875.7 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSQL Injection via MySQL Quote MethodCVE-2026-48188Public exploitFix available9.1 Critical
- otrsBypass DedicatedAgentToCustomerGroups SettingCVE-2026-481895.7 Medium
- otrsIncorrect handling of permissions in External Interface Config Item List moduleCVE-2026-481903.5 Low
- otrsWrong Permission Handling in Document Search Article Meta FiltersCVE-2026-481913.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreDenial-of-Service via SVG Rendering in TicketCVE-2026-48208Public exploit6.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreReflected XSS in authenticated agent contextCVE-2026-482097.1 High
- otrsPossible information disclosure via External InterfaceCVE-2026-482105.7 Medium
- otrs ag otrsPossible DoS via SQL BoxCVE-2026-6060Public exploit4.5 Medium
- otrs ag otrsPossible user enumerationCVE-2025-243915.3 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreUnsafe handling of AJAX callsCVE-2025-243883.8 Low
- otrsMissing CSRF protectionCVE-2025-243874.8 Medium
- otrs ag otrsMissing Cookie FlagsCVE-2025-243906.8 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreSMTP Password will be shown in cleartext on some SMTP errorsCVE-2025-243896.3 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreImproper check of permissions in Generic InterfaceCVE-2024-434463.5 Low
- otrs ag ((otrs)) community edition, otrs +1 moreMissing X-Content-Type-Options: nosniff Header Allows MIME Type SniffingCVE-2024-434455.4 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePasswords are written to Admin Log ModuleCVE-2024-434448.2 High
- otrs ag ((otrs)) community edition, otrs +1 moreStored XSS in process managementCVE-2024-434434.9 Medium
- otrs ag ((otrs)) community edition, otrs +1 moreStored XSS in System ConfigurationCVE-2024-434424.9 Medium
- otrsAgents are able to lock the ticket without the "Owner" permissionCVE-2024-237945.2 Medium
- otrsInformation exlosure in external interfaceCVE-2024-65405.7 Medium
- otrs, otrs community edition, otrs ag ((otrs)) community edition +2 moreUpload of files outside application directoryCVE-2024-237936.3 Medium
- otrsMissing file type check in avatar picture uploadCVE-2024-237903.5 Low
- otrsUnnecessary data is written to log if issues during indexing occursCVE-2024-237914.9 Medium
- otrsInsufficient access controlCVE-2024-237925.3 Medium
- otrsPassword is send back to clientCVE-2023-62548.1 High
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS execution in customer informationCVE-2023-54213.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreExternal pictures can be loaded even if not allowed by configurationCVE-2023-380595.3 Medium
- otrs, otrs ag ((otrs)) community edition, otrs community edition community edition +2 moreSSL Certificates are not checked for E-Mail HandlingCVE-2023-54228.7 High
- otrs, otrs ag ((otrs)) community edition +1 moreHost header injection by attachments in web serviceCVE-2023-38060Fix available6.3 Medium
- otrsTickets can be moved without permissionsCVE-2023-380584.1 Medium
- otrs survey, otrs ag ((otrs)) community edition, otrs +2 moreXSS stored in survey answersCVE-2023-380574.1 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreCode execution via System ConfigurationCVE-2023-380567.2 High
- otrsInformation disclouse and DoS via websocket push eventsCVE-2023-25347.6 High
- otrs, otrs ag ((otrs)) community edition +1 moreCode execution through ACL creationCVE-2023-12507.4 High
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS in Ticket ActionsCVE-2023-12486.1 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSQL Injection via OTRS Search APICVE-2022-4427Fix available6.5 Medium
- accessing template content without permissions otrsInformation exposure of template content due to missing check of permissionsCVE-2022-35013.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreDoS attack using emailCVE-2022-390527.5 High
- otrs, otrs ag ((otrs)) community edition +1 morePerl Code execution in Template ToolkitCVE-2022-390516.8 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS stored in customer informationCVE-2022-390504.6 Medium
- Show olderLoading…