Osticket

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:osticket:osticket:1.10.1:*:*:*:*:*:*:*

part: a version: 1.10.1 update: *

VendorOsticket (eb6b7f91-9003-595d-9b2a-e048d85decdd)
ProductOsticket (b8691a4e-029a-54ed-89df-dc236e440125)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/osticket/osticket purl2cpe 2026-06-01 10:11:00.285661

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2017-15580 vulnerable 2026-06-08 05:08:58.956406 Details available
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. An attacker can leverage this vulnerability to upload arbitrary files on the web application having malicious content.
Published: 2017-10-23T08:00:00.000Z
Updated: 2024-08-05T19:57:27.045Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-15362 vulnerable 2026-06-08 05:08:58.781013 Details available
osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.
Published: 2017-10-16T01:00:00.000Z
Updated: 2024-08-05T19:57:25.887Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.