Enhancesoft

CVE-2026-22200 Jan 12, 19:16 HIGH POC PATCH THREAT Act Now

Arbitrary local file read in Enhancesoft osTicket 1.18.x (before 1.18.3) and 1.17.x (before 1.17.7) lets a remote unauthenticated attacker embed the contents of server-side files into an exported ticket PDF. By submitting a ticket whose rich-text HTML carries crafted PHP filter expressions, the attacker abuses the mPDF export path to render attacker-chosen files as bitmap images, disclosing sensitive data such as configuration files and credentials. Publicly available exploit code exists (Horizon3 'Ticket to Shell' research) and the EPSS score of 13.58% (94th percentile) reflects elevated near-term exploitation likelihood; there is no public exploit identified as active in CISA KEV.

CVE-2026-9507 Jun 16, 11:47 MEDIUM PATCH This Month

Session fixation in osTicket v1.18.2 enables remote attackers to hijack authenticated user accounts by pre-seeding a known OSTSESSID cookie before the victim logs in. The application fails to invalidate or regenerate the session identifier upon successful authentication, so an attacker who plants a known token in the victim's browser retains access to that session once the victim authenticates. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 5.1 (Medium) reflects limited per-account impact and a mandatory victim-interaction prerequisite.

CVE-2023-27149 Oct 23, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-27148 Oct 23, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-45811 Sep 08, 02:15 MEDIUM POC This Month

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id". Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-30082 Jun 14, 20:15 HIGH POC This Week

A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-1320 Mar 10, 16:15 MEDIUM POC PATCH This Month

Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2023-1319 Mar 10, 16:15 MEDIUM POC PATCH This Month

Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-1318 Mar 10, 16:15 MEDIUM POC PATCH This Month

Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-1317 Mar 10, 16:15 MEDIUM POC PATCH This Month

Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-1316 Mar 10, 16:15 MEDIUM POC PATCH This Month

Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-1315 Mar 10, 16:15 MEDIUM POC PATCH This Month

Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2022-4271 Dec 02, 16:15 MEDIUM POC PATCH This Month

Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2022-32074 Jul 13, 16:15 MEDIUM PATCH This Month

A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-24881 Nov 02, 21:15 CRITICAL POC PATCH THREAT Act Now

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 73.3%.

CVE-2020-24917 Aug 30, 16:15 MEDIUM PATCH This Month

osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-16193 Aug 26, 12:15 MEDIUM PATCH This Month

osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-14012 Jun 10, 18:15 MEDIUM POC This Month

scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-12629 May 04, 13:15 MEDIUM POC PATCH This Month

include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2019-14750 Aug 07, 17:15 MEDIUM POC PATCH THREAT This Month

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.7%.

CVE-2019-14749 Aug 07, 17:15 HIGH POC PATCH This Week

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2019-14748 Aug 07, 17:15 MEDIUM POC PATCH This Month

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2019-13397 Jul 09, 17:15 MEDIUM This Month

Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-11537 Apr 25, 19:29 MEDIUM POC This Month

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-7196 Mar 27, 17:29 MEDIUM POC This Month

Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-7195 Mar 27, 17:29 HIGH POC This Week

Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

CVE-2018-7194 Mar 27, 17:29 MEDIUM POC This Month

Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-7193 Mar 27, 17:29 MEDIUM POC This Month

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-7192 Mar 27, 17:29 MEDIUM POC This Month

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2014-4744 Jul 09, 14:55 MEDIUM POC PATCH This Month

Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.