VendorsEnhancesoftosticketall versions
Vulnerabilities

Enhancesoft osTicket

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

45CVEs
CVE-2023-27149
A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list.
Published 2023-10-23 · Modified
4.8EPSS 0.004
CVE-2014-4744
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php.
Published 2014-07-09 · Modified
4.3EPSS 0.019
CVE-2015-1176
Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.
Published 2015-01-23 · Modified
4.3EPSS 0.019
CVE-2015-1347
Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Published 2015-01-23 · Modified
4.3EPSS 0.014
CVE-2010-0606
Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.
Published 2010-02-11 · Modified
3.5EPSS 0.009
← Prev2 / 2