VendorsEnhancesoftosticket1.2.7
Vulnerabilities

Enhancesoft osTicket 1.2.7

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

4CVEs
CVE-2010-0605
SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter.
Published 2010-02-11 · Modified
7.51 PoCEPSS 0.030
CVE-2005-1436
Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via (1) the t parameter to view.php, (2) the osticket_title parameter to header.php, (3) the em parameter to admin_login.php, (4) the e parameter to user_login.php, (5) the err parameter to open_submit.php, or (6) the name and subject fields when adding a ticket.
Published 2005-05-03 · Modified
6.8EPSS 0.017
CVE-2014-4744
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php.
Published 2014-07-09 · Modified
4.3EPSS 0.019
CVE-2010-0606
Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.
Published 2010-02-11 · Modified
3.5EPSS 0.009