What’s Vulnerable › Products

Best Practical Request Tracker vulnerabilities

34 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your Best Practical Request Tracker version is affected

Latest Best Practical Request Tracker vulnerabilities

• CVE-2026-44231 — RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint (CVSS 9.1)
• CVE-2026-44230 — RT: Reflected Cross-Site Scripting in search results chart (CVSS 6.1)
• CVE-2026-44229 — RT: Cross-Site Scripting via inline-served uploaded content (CVSS 5.4)
• CVE-2026-44228 — RT: Stored Cross-Site Scripting via insufficient template escaping (CVSS 5.4)
• CVE-2026-44227 — RT: Reflected Cross-Site Scripting via URL parameters (CVSS 6.1)
• CVE-2026-6841 — Reflected XSS in Request Tracker (CVSS 6.1)
• CVE-2025-61873 — (CVSS 2.6)
• CVE-2025-9158 — Stored XSS in Request Tracker (CVSS 5.3)
• CVE-2025-31501 — (CVSS 6.1)
• CVE-2025-31500 — (CVSS 6.1)
• CVE-2025-30087 — (CVSS 6.1)
• CVE-2023-45024 — (CVSS 7.5)
• CVE-2023-41260 — (CVSS 7.5)
• CVE-2023-41259 — (CVSS 7.5)
• CVE-2022-25803 — (CVSS 6.1)
• CVE-2022-25802 — (CVSS 6.1)
• CVE-2021-38562 — (CVSS 7.5)
• CVE-2018-18898 — (CVSS 7.5)
• CVE-2017-5944 — (CVSS 8.8)
• CVE-2017-5943 — (CVSS 8.8)
• CVE-2017-5361 — (CVSS 5.9)
• CVE-2016-6127 — (CVSS 6.1)
• CVE-2015-6506 — (CVSS 4.3)
• CVE-2015-5475 — (CVSS 4.3)
• CVE-2015-1464 — (CVSS 6.4)