彙總 Best Practical 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 跨站腳本與路徑處理缺陷 等問題，部分漏洞可能導致 資料外洩，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2026-6841 | Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser. This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2. | [email protected] | 5.1 | 0.24% | 2026-05-21 | 2026-06-17 |
| CVE-2025-61873 | Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. | [email protected] | 2.6 | 0.19% | 2026-01-16 | 2026-06-17 |
| CVE-2025-31501 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink. | [email protected] | 7.2 | 0.18% | 2025-05-28 | 2026-06-17 |
| CVE-2025-31500 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name. | [email protected] | 7.2 | 0.18% | 2025-05-28 | 2026-06-17 |
| CVE-2025-30087 | Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL. | [email protected] | 7.2 | 0.27% | 2025-05-28 | 2026-06-17 |
| CVE-2023-45024 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. | [email protected] | 7.5 | 0.60% | 2023-11-03 | 2026-06-17 |
| CVE-2023-41260 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. | [email protected] | 7.5 | 0.70% | 2023-11-03 | 2026-06-17 |
| CVE-2023-41259 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call. | [email protected] | 7.5 | 0.72% | 2023-11-03 | 2026-06-17 |
| CVE-2022-25803 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. | [email protected] | 6.1 | 0.43% | 2022-07-14 | 2026-06-17 |
| CVE-2022-25802 | Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment. | [email protected] | 6.1 | 0.59% | 2022-07-14 | 2026-06-17 |
| CVE-2022-25801 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. | [email protected] | 9.1 | 0.70% | 2022-07-14 | 2026-06-17 |
| CVE-2022-25800 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. | [email protected] | 9.1 | 0.70% | 2022-07-14 | 2026-06-17 |
| CVE-2021-38562 | Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm. | [email protected] | 7.5 | 1.71% | 2021-10-18 | 2026-06-17 |
| CVE-2018-18898 | The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing. | [email protected] | 7.5 | 2.36% | 2019-03-21 | 2026-06-16 |
| CVE-2017-5944 | The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name. | [email protected] | 8.8 | 2.78% | 2017-07-03 | 2026-06-16 |
| CVE-2017-5943 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) verification tokens via a crafted URL. | [email protected] | 8.8 | 0.83% | 2017-07-03 | 2026-06-16 |
| CVE-2017-5361 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack. | [email protected] | 5.9 | 1.37% | 2017-07-03 | 2026-06-16 |
| CVE-2016-6127 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type. | [email protected] | 6.1 | 1.20% | 2017-07-03 | 2026-06-16 |
| CVE-2015-6506 | Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key. | [email protected] | 4.3 | 2.08% | 2015-09-03 | 2026-06-16 |
| CVE-2015-5475 | Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages. | [email protected] | 4.3 | 2.08% | 2015-08-14 | 2026-06-16 |