Log in Start free

OTRS AG

Products

ProductCVEsExploitedLatest
OTRS75–Jun 1, 2026
((OTRS)) Community Edition46–Jun 1, 2026
OTRSCIsInCustomerFrontend2–Mar 22, 2021
OTRSCustomContactFields1–Feb 7, 2022
OTRSSTORM1–Mar 21, 2022
OTRSTicketForms1–Feb 8, 2021
Survey1–Feb 8, 2021
SystemMonitoring1–Mar 21, 2022
FAQ1–Mar 22, 2021
Time Accounting1–Jul 26, 2021
ITSMConfigurationManagement1–Mar 22, 2021
OTRSCalendarResourcePlanning1–Jun 13, 2022

Exploited and recent CVEs

  • CVE-2026-48187 Medium 5.7 Email with special content can lead to DoS 0.2%
  • CVE-2026-48187 Medium 5.7 Email with special content can lead to DoS 0.2%
  • CVE-2026-48188 Critical 9.1 SQL Injection via MySQL Quote Method 0.7%
  • CVE-2026-48188 Critical 9.1 SQL Injection via MySQL Quote Method 0.7%
  • CVE-2026-48189 Medium 5.7 Bypass DedicatedAgentToCustomerGroups Setting 0.2%
  • CVE-2026-48190 Low 3.5 Incorrect handling of permissions in External Interface Config Item List module 0.1%
  • CVE-2026-48191 Low 3.5 Wrong Permission Handling in Document Search Article Meta Filters 0.1%
  • CVE-2026-48208 Medium 6.5 Denial-of-Service via SVG Rendering in Ticket 0.3%
  • CVE-2026-48208 Medium 6.5 Denial-of-Service via SVG Rendering in Ticket 0.3%
  • CVE-2026-48209 High 7.1 Reflected XSS in authenticated agent context 0.2%
  • CVE-2026-48209 High 7.1 Reflected XSS in authenticated agent context 0.2%
  • CVE-2026-48210 Medium 5.7 Possible information disclosure via External Interface 0.2%
  • CVE-2026-6060 Medium 4.5 Possible DoS via SQL Box 0.2%
  • CVE-2025-24391 Medium 5.3 Possible user enumeration 0.3%
  • CVE-2025-24388 Low 3.8 Unsafe handling of AJAX calls 0.3%
  • CVE-2025-24388 Low 3.8 Unsafe handling of AJAX calls 0.3%
  • CVE-2025-24387 Medium 4.8 Missing CSRF protection 0.2%
  • CVE-2025-24390 Medium 6.8 Missing Cookie Flags 0.2%
  • CVE-2025-24389 Medium 6.3 SMTP Password will be shown in cleartext on some SMTP errors 0.1%
  • CVE-2025-24389 Medium 6.3 SMTP Password will be shown in cleartext on some SMTP errors 0.1%
  • CVE-2024-43446 Low 3.5 Improper check of permissions in Generic Interface 0.2%
  • CVE-2024-43446 Low 3.5 Improper check of permissions in Generic Interface 0.2%
  • CVE-2024-43445 Medium 5.4 Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing 0.2%
  • CVE-2024-43445 Medium 5.4 Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing 0.2%
  • CVE-2024-43444 High 8.2 Passwords are written to Admin Log Module 0.4%
  • CVE-2024-43444 High 8.2 Passwords are written to Admin Log Module 0.4%
  • CVE-2024-43443 Medium 4.9 Stored XSS in process management 0.4%
  • CVE-2024-43443 Medium 4.9 Stored XSS in process management 0.4%
  • CVE-2024-43442 Medium 4.9 Stored XSS in System Configuration 0.4%
  • CVE-2024-43442 Medium 4.9 Stored XSS in System Configuration 0.4%