CVE-2018-7196

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-03-27 · updated 2026-07-10
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter.

Affected products

osticket/osticket: through 1.10.1

References

https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c
https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c

Get alerted when CVE-2018-7196 or the next vulnerability affects your stack