GCVE - cpe:2.3:a:osticket:osticket:1.2.7:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:osticket:osticket:1.2.7:*:*:*:*:*:*:*

part: a version: 1.2.7 update: *

Vendor	Osticket (`eb6b7f91-9003-595d-9b2a-e048d85decdd`)
Product	Osticket (`b8691a4e-029a-54ed-89df-dc236e440125`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/osticket/osticket`	purl2cpe	2026-06-01 10:11:00.285675

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-4744`	vulnerable	2026-06-08 05:05:45.674950	Details available Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php. Published: 2014-07-09T14:00:00.000Z Updated: 2024-08-06T11:27:36.495Z Open on db.gcve.eu Reference links https://www.netsparker.com/critical-xss-vulnerabilities-in-osticket/ http://www.securityfocus.com/bid/68500 https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.2 http://secunia.com/advisories/59539	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0606`	vulnerable	2026-06-08 04:52:03.560051	Details available Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php. Published: 2010-02-11T17:00:00.000Z Updated: 2024-09-16T18:55:15.884Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/38166 http://osticket.com/forums/project.php?issueid=176 http://secunia.com/advisories/38515 http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-ReflectedXSS.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0605`	vulnerable	2026-06-08 04:52:03.556922	Details available SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter. Published: 2010-02-11T17:00:00.000Z Updated: 2024-08-07T00:52:19.478Z Open on db.gcve.eu Reference links http://www.exploit-db.com/exploits/11380 http://www.securityfocus.com/bid/38166 http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-SQLi.pdf http://osticket.com/forums/project.php?issueid=176 http://secunia.com/advisories/38515	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-1436`	vulnerable	2026-06-08 04:48:26.634719	Details available Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via (1) the t parameter to view.php, (2) the osticket_title parameter to header.php, (3) the em parameter to admin_login.php, (4) the e parameter to user_login.php, (5) the err parameter to open_submit.php, or (6) the name and subject fields when adding a ticket. Published: 2005-05-03T04:00:00.000Z Updated: 2024-08-07T21:51:49.951Z Open on db.gcve.eu Reference links http://www.osvdb.org/16274 http://www.gulftech.org/?node=research&article_id=00071-05022005 http://www.osvdb.org/16271 http://www.osvdb.org/16270 http://www.osvdb.org/16272	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.