Otrs Ag Otrs
75 CVEs affecting Otrs Ag Otrs. Latest disclosed: 2026-06-01. Critical: 1, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48188 | Critical | 9.1 | 2026-06-01 | An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead t… |
CVE-2023-5422 | High | 8.7 | 2023-10-16 | The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify… |
CVE-2024-43444 | High | 8.2 | 2024-08-26 | Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match… |
CVE-2023-6254 | High | 8.1 | 2023-11-27 | A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server respons… |
CVE-2023-2534 | High | 7.6 | 2023-05-08 | Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain l… |
CVE-2022-39052 | High | 7.5 | 2022-10-17 | An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system |
CVE-2021-21441 | High | 7.5 | 2021-06-16 | There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Att… |
CVE-2023-1250 | High | 7.4 | 2023-03-20 | Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When cr… |
CVE-2020-1773 | High | 7.3 | 2020-03-27 | An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able t… |
CVE-2023-38056 | High | 7.2 | 2023-07-24 | Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authen… |
CVE-2026-48209 | High | 7.1 | 2026-06-01 | An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected… |
CVE-2025-24390 | Medium | 6.8 | 2025-01-27 | A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS… |
CVE-2022-39051 | Medium | 6.8 | 2022-09-05 | Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package |
CVE-2026-48208 | Medium | 6.5 | 2026-06-01 | An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SV… |
CVE-2022-4427 | Medium | 6.5 | 2022-12-19 | Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects… |
CVE-2021-36092 | Medium | 6.5 | 2021-07-26 | It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community… |
CVE-2021-21439 | Medium | 6.5 | 2021-06-14 | DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or i… |
CVE-2020-1772 | Medium | 6.5 | 2020-03-27 | It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which alr… |
CVE-2021-36100 | Medium | 6.4 | 2022-03-21 | Specially crafted string in OTRS system configuration can allow the execution of any system command. |
CVE-2025-24389 | Medium | 6.3 | 2025-01-27 | Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system… |