Known vulnerabilities in osTicket

Vendor: osTicket.com
Software: osTicket
Software CPE: cpe:2.3:a:osticket_com:osticket:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 28
Public exploits: 5
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting osTicket osTicket is affected by 28 known vulnerabilities: 4 high, 4 medium, 20 low Critical High Medium Low

Vulnerabilities (28)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU63475 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.15.8, 1.16.3 20.05.2022 SB2022052006
#VU63474 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.15.8, 1.16.3 20.05.2022 SB2022052006
#VU57173 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.8, 1.15.4 08.10.2021 SB2021100812
#VU57172 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.8, 1.15.4 08.10.2021 SB2021100812
#VU57171 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.8, 1.15.4 08.10.2021 SB2021100812
#VU57170 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.8, 1.15.4 08.10.2021 SB2021100812
#VU57169 - Server-Side Request Forgery (SSRF)
 CWE-918 Medium
No
No
 1.14.8, 1.15.4 08.10.2021 SB2021100812
#VU57168 - Exposure of sensitive information to an unauthorized actor
 CWE-200 Medium
No
No
 1.14.8, 1.15.4 08.10.2021 SB2021100812
#VU57167 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
 CWE-89 High
No
No
 1.14.8, 1.15.4 08.10.2021 SB2021100812
#VU55412 - Improper Control of Interaction Frequency
 CWE-799 Low
No
No
 1.14.7, 1.15.3 28.07.2021 SB2021072816
#VU55411 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.7, 1.15.3 28.07.2021 SB2021072816
#VU55410 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.7, 1.15.3 28.07.2021 SB2021072816
#VU51237 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.6, 1.15.2 04.03.2021 SB2021030430
#VU51236 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.6, 1.15.2 04.03.2021 SB2021030430
#VU46275 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-24917		 CWE-79 Low
No
No
 1.14.3 30.08.2020 SB2020090606
#VU29533 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-14012		 CWE-79 Low
No
No
 - 06.07.2020 SB2020061047
#VU28308 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.2 28.05.2020 SB2020050427
#VU28307 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Low
No
No
 1.14.2 28.05.2020 SB2020050427
#VU27509 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-12629		 CWE-79 Low
Available
No
 1.14.2 04.05.2020 SB2020050427
#VU30830 - Unrestricted Upload of File with Dangerous Type
CVE-2019-14748		 CWE-434 Medium
Available
No
 1.12.1 07.08.2019 SB2019080755


Showing elements 1 - 20 out of 28