GCVE - cpe:2.3:a:osticket:osticket:1.6:rc4:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:osticket:osticket:1.6:rc4:*:*:*:*:*:*

part: a version: 1.6 update: rc4

Vendor	Osticket (`eb6b7f91-9003-595d-9b2a-e048d85decdd`)
Product	Osticket (`b8691a4e-029a-54ed-89df-dc236e440125`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/osticket/osticket`	purl2cpe	2026-06-01 10:11:00.285683

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-4744`	vulnerable	2026-06-08 05:05:45.678027	Details available Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php. Published: 2014-07-09T14:00:00.000Z Updated: 2024-08-06T11:27:36.495Z Open on db.gcve.eu Reference links https://www.netsparker.com/critical-xss-vulnerabilities-in-osticket/ http://www.securityfocus.com/bid/68500 https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.2 http://secunia.com/advisories/59539	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0606`	vulnerable	2026-06-08 04:52:03.560135	Details available Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php. Published: 2010-02-11T17:00:00.000Z Updated: 2024-09-16T18:55:15.884Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/38166 http://osticket.com/forums/project.php?issueid=176 http://secunia.com/advisories/38515 http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-ReflectedXSS.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0605`	vulnerable	2026-06-08 04:52:03.559551	Details available SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter. Published: 2010-02-11T17:00:00.000Z Updated: 2024-08-07T00:52:19.478Z Open on db.gcve.eu Reference links http://www.exploit-db.com/exploits/11380 http://www.securityfocus.com/bid/38166 http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-SQLi.pdf http://osticket.com/forums/project.php?issueid=176 http://secunia.com/advisories/38515	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.