What’s Vulnerable › Vulnerabilities

CVE-2025-45387

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-02 · updated 2026-06-17
• Weakness: CWE-79

Description

osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.

Affected products

• Osticket: before 1.17.6; from 1.18 before 1.18.2 — fixed in 1.17.6, 1.18.2

How to fix

Upgrade to a fixed version: Osticket 1.17.6, 1.18.2. Check the vendor advisory for mitigations.

References

• https://github.com/UmerAdeemCheema/CVE-Security-Research/blob/main/OSTicket/Unauthorized%20Access%20to%20Ajax%20Functions.md
• https://github.com/osTicket/osTicket
• https://github.com/osTicket/osTicket/pull/6802/commits/ab6672faa0991de305d4b90a3faa2e3cebdd23c8

Get alerted when CVE-2025-45387 or the next vulnerability affects your stack