Approved changes feed: RSS · Atom
cpe:2.3:a:osticket:osticket:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Osticket (eb6b7f91-9003-595d-9b2a-e048d85decdd) |
|---|---|
| Product | Osticket (b8691a4e-029a-54ed-89df-dc236e440125) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/osticket/osticket |
purl2cpe | 2026-06-01 10:11:00.281500 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14871 |
vulnerable | 2026-07-29 00:26:17.616342 |
osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
Published: 2026-07-17T14:55:32.945Z
Updated: 2026-07-17T15:28:21.159Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8194 |
vulnerable | 2026-06-08 08:08:58.190721 |
osTicket Dispatcher class.dispatcher.php cross-site request forgery
MEDIUM (4.3)
A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument _method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
Published: 2026-05-09T19:30:09.900Z
Updated: 2026-05-11T17:32:03.972Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-45387 |
vulnerable | 2026-06-08 07:25:10.999816 |
Details available
osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.
Published: 2025-06-02T00:00:00.000Z
Updated: 2025-06-02T20:33:09.293Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26241 |
vulnerable | 2026-06-08 07:12:51.498794 |
Details available
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.
Published: 2025-05-05T00:00:00.000Z
Updated: 2025-05-05T17:37:09.902Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32074 |
vulnerable | 2026-06-08 05:44:42.547820 |
Details available
A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
Published: 2022-07-13T15:35:28.000Z
Updated: 2024-08-03T07:32:55.955Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24917 |
vulnerable | 2026-06-08 05:22:35.723652 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24881 |
vulnerable | 2026-06-08 05:22:35.687299 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16193 |
vulnerable | 2026-06-08 05:19:27.501847 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14750 |
vulnerable | 2026-06-08 05:12:55.973286 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14749 |
vulnerable | 2026-06-08 05:12:55.972903 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14748 |
vulnerable | 2026-06-08 05:12:55.972443 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11537 |
vulnerable | 2026-06-08 05:12:37.526940 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7196 |
vulnerable | 2026-06-08 05:11:55.157800 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7195 |
vulnerable | 2026-06-08 05:11:55.157411 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7194 |
vulnerable | 2026-06-08 05:11:55.156917 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7193 |
vulnerable | 2026-06-08 05:11:55.156612 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7192 |
vulnerable | 2026-06-08 05:11:55.156203 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-1347 |
vulnerable | 2026-06-08 05:06:25.401279 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-1176 |
vulnerable | 2026-06-08 05:06:25.114856 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-4744 |
vulnerable | 2026-06-08 05:05:45.673515 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-5407 |
vulnerable | 2026-06-08 04:49:20.424218 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2005-1439 |
vulnerable | 2026-06-08 04:48:26.639226 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.