GCVE - cpe:2.3:a:osticket:osticket:1.6:rc1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:osticket:osticket:1.6:rc1:*:*:*:*:*:*

part: a version: 1.6 update: rc1

Vendor	Osticket (`eb6b7f91-9003-595d-9b2a-e048d85decdd`)
Product	Osticket (`b8691a4e-029a-54ed-89df-dc236e440125`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/osticket/osticket`	purl2cpe	2026-06-01 10:11:00.285679

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-4744`	vulnerable	2026-06-08 05:05:45.676382	Details available Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php. Published: 2014-07-09T14:00:00.000Z Updated: 2024-08-06T11:27:36.495Z Open on db.gcve.eu Reference links https://www.netsparker.com/critical-xss-vulnerabilities-in-osticket/ http://www.securityfocus.com/bid/68500 https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.2 http://secunia.com/advisories/59539	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0606`	vulnerable	2026-06-08 04:52:03.560087	Details available Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php. Published: 2010-02-11T17:00:00.000Z Updated: 2024-09-16T18:55:15.884Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/38166 http://osticket.com/forums/project.php?issueid=176 http://secunia.com/advisories/38515 http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-ReflectedXSS.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0605`	vulnerable	2026-06-08 04:52:03.557991	Details available SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter. Published: 2010-02-11T17:00:00.000Z Updated: 2024-08-07T00:52:19.478Z Open on db.gcve.eu Reference links http://www.exploit-db.com/exploits/11380 http://www.securityfocus.com/bid/38166 http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-SQLi.pdf http://osticket.com/forums/project.php?issueid=176 http://secunia.com/advisories/38515	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2361`	vulnerable	2026-06-08 04:51:28.016904	Details available SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter. Published: 2009-07-08T15:00:00.000Z Updated: 2024-08-07T05:44:56.073Z Open on db.gcve.eu Reference links http://osticket.com/forums/project.php?issueid=118 http://www.osvdb.org/55472 http://www.exploit-db.com/exploits/9032 http://www.securityfocus.com/archive/1/504615/100/0/threaded http://www.ngenuity.org/wordpress/2009/06/26/osticket-admin-login-blind-sql-injection/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.