osticket/osticket vulnerabilities

48 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Latest osticket/osticket vulnerabilities

CVE-2026-14871 — osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure (CVSS 7.1)
CVE-2026-36214 — (CVSS 6.4)
CVE-2026-9507 — Session fixation vulnerability in Enhancesoft's osTicket (CVSS 5.1)
CVE-2026-26895 — (CVSS 5.3)
CVE-2026-22200 — osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read (CVSS 7.5)
CVE-2025-26241 — (CVSS 6.5)
CVE-2023-46967 — (CVSS 6.1)
CVE-2023-27149 — (CVSS 4.8)
CVE-2023-27148 — (CVSS 4.8)
CVE-2021-45811 — (CVSS 6.5)
CVE-2023-30082 — (CVSS 7.5)
CVE-2022-31888 — (CVSS 8.8)
CVE-2023-1320 — Cross-site Scripting (XSS) - Stored in osticket/osticket (CVSS 6.1)
CVE-2023-1319 — Cross-site Scripting (XSS) - Stored in osticket/osticket (CVSS 4.8)
CVE-2023-1318 — Cross-site Scripting (XSS) - Generic in osticket/osticket (CVSS 5.4)
CVE-2023-1317 — Cross-site Scripting (XSS) - Reflected in osticket/osticket (CVSS 5.4)
CVE-2023-1316 — Cross-site Scripting (XSS) - Stored in osticket/osticket (CVSS 5.4)
CVE-2023-1315 — Cross-site Scripting (XSS) - Reflected in osticket/osticket (CVSS 5.4)
CVE-2022-4271 — Cross-site Scripting (XSS) - Reflected in osticket/osticket (CVSS 5.4)
CVE-2022-32074 — (CVSS 5.4)
CVE-2021-42235 — (CVSS 9.8)
CVE-2020-22609 — (CVSS 6.1)
CVE-2020-22608 — (CVSS 6.1)
CVE-2020-24881 — (CVSS 9.8)
CVE-2020-24917 — (CVSS 6.1)