Bestpractical Request Tracker
32 CVEs affecting Bestpractical Request Tracker. Latest disclosed: 2026-07-20. Critical: 1, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44231 | Critical | 9.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information discl… |
CVE-2017-5944 | High | 8.8 | 2017-07-03 | The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated us… |
CVE-2017-5943 | High | 8.8 | 2017-07-03 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site re… |
CVE-2023-45024 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. |
CVE-2023-41260 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. |
CVE-2023-41259 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or… |
CVE-2021-38562 | High | 7.5 | 2021-10-18 | Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack again… |
CVE-2018-18898 | High | 7.5 | 2019-03-21 | The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity att… |
CVE-2025-31501 | High | 7.2 | 2025-05-28 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink. |
CVE-2025-31500 | High | 7.2 | 2025-05-28 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name. |
CVE-2025-30087 | High | 7.2 | 2025-05-28 | Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL. |
CVE-2026-44230 | Medium | 6.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6… |
CVE-2026-44227 | Medium | 6.1 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS… |
CVE-2026-6841 | Medium | 6.1 | 2026-05-21 | Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL tha… |
CVE-2022-25803 | Medium | 6.1 | 2022-07-14 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. |
CVE-2022-25802 | Medium | 6.1 | 2022-07-14 | Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment. |
CVE-2016-6127 | Medium | 6.1 | 2017-07-03 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachm… |
CVE-2017-5361 | Medium | 5.9 | 2017-07-03 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes… |
CVE-2026-44229 | Medium | 5.4 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Sit… |
CVE-2026-44228 | Medium | 5.4 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS)… |