Aggregates CVE and security vulnerability intelligence across all osticket-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk sql injection, vendor risk ssrf, and vendor risk path handling and related problems; some flaws may lead to vendor impact memory corruption and vendor impact file overwrite.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-45387 | osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php. | [email protected] | 5.4 | 0.13% | 2025-06-02 | 2025-06-05 |
| CVE-2025-26241 | A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination. | [email protected] | 6.5 | 0.25% | 2025-05-05 | 2025-06-13 |
| CVE-2022-32074 | A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file. | [email protected] | 5.4 | 0.97% | 2022-07-13 | 2024-11-21 |
| CVE-2020-24881 | SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. | [email protected] | 9.8 | 91.34% | 2020-11-02 | 2024-11-21 |
| CVE-2020-24917 | osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php. | [email protected] | 6.1 | 0.31% | 2020-08-30 | 2024-11-21 |
| CVE-2020-16193 | osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call. | [email protected] | 5.4 | 0.21% | 2020-08-26 | 2024-11-21 |
| CVE-2019-14750 | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions. | [email protected] | 6.1 | 3.35% | 2019-08-07 | 2024-11-21 |
| CVE-2019-14749 | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and Op | [email protected] | 8.8 | 13.16% | 2019-08-07 | 2024-11-21 |
| CVE-2019-14748 | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attach | [email protected] | 5.4 | 0.44% | 2019-08-07 | 2024-11-21 |
| CVE-2019-11537 | In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion. | [email protected] | 6.1 | 4.03% | 2019-04-25 | 2024-11-21 |
| CVE-2018-7196 | Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. | [email protected] | 6.1 | 0.72% | 2018-03-27 | 2024-11-21 |
| CVE-2018-7195 | Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number. | [email protected] | 8.1 | 0.37% | 2018-03-27 | 2024-11-21 |
| CVE-2018-7194 | Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting. | [email protected] | 4.9 | 1.02% | 2018-03-27 | 2024-11-21 |
| CVE-2018-7193 | Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter. | [email protected] | 6.1 | 0.32% | 2018-03-27 | 2024-11-21 |
| CVE-2018-7192 | Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter. | [email protected] | 6.1 | 0.13% | 2018-03-27 | 2024-11-21 |
| CVE-2017-15580 | osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content. | [email protected] | 9.8 | 35.84% | 2017-10-23 | 2026-05-13 |
| CVE-2017-15362 | osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176. | [email protected] | 6.1 | 0.40% | 2017-10-16 | 2026-05-13 |
| CVE-2017-14396 | In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php. | [email protected] | 9.8 | 1.97% | 2017-09-12 | 2026-05-13 |
| CVE-2015-1347 | Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. | [email protected] | 4.3 | 0.22% | 2015-01-23 | 2026-05-06 |
| CVE-2015-1176 | Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action. | [email protected] | 4.3 | 0.30% | 2015-01-23 | 2026-05-06 |