GCVE - cpe:2.3:a:enhancesoft:osticket:1.17.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:enhancesoft:osticket:1.17.2:*:*:*:*:*:*:*

part: a version: 1.17.2 update: *

Vendor	Enhancesoft (`367b7ba2-13a6-5d85-8768-beb77802180c`)
Product	Osticket (`33a9a145-9835-5d5a-a4ea-fac1c7aff0c6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/osticket/osticket`	purl2cpe	2026-06-01 10:13:25.299039
`pkg:github/osticket/osticket-1.7`	purl2cpe	2026-06-01 10:13:25.299040
`pkg:sourceforge/osticket`	purl2cpe	2026-06-01 10:13:25.299042

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-30082`	vulnerable	2026-06-08 06:02:43.812798	Details available A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory. Published: 2023-06-14T00:00:00.000Z Updated: 2025-01-06T16:29:00.775Z Open on db.gcve.eu Reference links https://github.com/manavparekh/CVEs/blob/main/CVE-2023-30082/Steps%20to%20reproduce.txt https://blog.manavparekh.com/2023/06/cve-2023-30082.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-27149`	vulnerable	2026-06-08 05:57:40.675455	Details available A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list. Published: 2023-10-23T00:00:00.000Z Updated: 2024-09-11T20:03:23.912Z Open on db.gcve.eu Reference links https://www.esecforte.com/cve-2023-27149-osticket_xss/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-27148`	vulnerable	2026-06-08 05:57:40.674925	Details available A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter. Published: 2023-10-23T00:00:00.000Z Updated: 2024-09-11T20:04:38.791Z Open on db.gcve.eu Reference links https://www.esecforte.com/cve-2023-27148-osticket_xss/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.