Enhancesoft Osticket
46 CVEs affecting Enhancesoft Osticket. Latest disclosed: 2026-06-16. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-42235 | Critical | 9.8 | 2022-05-04 | SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionalit… |
CVE-2020-24881 | Critical | 9.8 | 2020-11-02 | SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. |
CVE-2022-31888 | High | 8.8 | 2023-04-05 | Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2. |
CVE-2019-14749 | High | 8.8 | 2019-08-07 | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These… |
CVE-2018-7195 | High | 8.1 | 2018-03-27 | Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access… |
CVE-2026-22200 | High | 7.5 | 2026-01-12 | Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functiona… |
CVE-2023-30082 | High | 7.5 | 2023-06-14 | A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket… |
CVE-2025-26241 | Medium | 6.5 | 2025-05-05 | A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL… |
CVE-2021-45811 | Medium | 6.5 | 2023-09-08 | A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL co… |
CVE-2023-46967 | Medium | 6.1 | 2024-02-20 | Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted suppor… |
CVE-2023-1320 | Medium | 6.1 | 2023-03-10 | Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. |
CVE-2020-22609 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php. |
CVE-2020-22608 | Medium | 6.1 | 2021-06-28 | Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php. |
CVE-2020-24917 | Medium | 6.1 | 2020-08-30 | osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php. |
CVE-2019-14750 | Medium | 6.1 | 2019-08-07 | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization… |
CVE-2019-13397 | Medium | 6.1 | 2019-07-09 | Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file ex… |
CVE-2019-11537 | Medium | 6.1 | 2019-04-25 | In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user… |
CVE-2018-7196 | Medium | 6.1 | 2018-03-27 | Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2018-7193 | Medium | 6.1 | 2018-03-27 | Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or… |
CVE-2018-7192 | Medium | 6.1 | 2018-03-27 | Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web scr… |