OTRS AG ((OTRS)) Community Edition

• CVE-2026-48187 Medium 5.7 Email with special content can lead to DoS 0.2%
• CVE-2026-48188 Critical 9.1 SQL Injection via MySQL Quote Method 0.7%
• CVE-2026-48208 Medium 6.5 Denial-of-Service via SVG Rendering in Ticket 0.3%
• CVE-2026-48209 High 7.1 Reflected XSS in authenticated agent context 0.2%
• CVE-2025-24388 Low 3.8 Unsafe handling of AJAX calls 0.3%
• CVE-2025-24389 Medium 6.3 SMTP Password will be shown in cleartext on some SMTP errors 0.1%
• CVE-2024-43446 Low 3.5 Improper check of permissions in Generic Interface 0.2%
• CVE-2024-43445 Medium 5.4 Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing 0.2%
• CVE-2024-43444 High 8.2 Passwords are written to Admin Log Module 0.4%
• CVE-2024-43443 Medium 4.9 Stored XSS in process management 0.4%
• CVE-2024-43442 Medium 4.9 Stored XSS in System Configuration 0.4%
• CVE-2024-23793 Medium 6.3 Upload of files outside application directory 0.8%
• CVE-2023-5421 Low 3.5 Possible XSS execution in customer information 0.4%
• CVE-2023-38059 Medium 5.3 External pictures can be loaded even if not allowed by configuration 0.5%
• CVE-2023-5422 High 8.7 SSL Certificates are not checked for E-Mail Handling 0.3%
• CVE-2023-38060 Medium 6.3 Host header injection by attachments in web service 0.7%
• CVE-2023-38057 Medium 4.1 XSS stored in survey answers 0.4%
• CVE-2023-38056 High 7.2 Code execution via System Configuration 0.9%
• CVE-2023-1250 High 7.4 Code execution through ACL creation 0.3%
• CVE-2023-1248 Medium 6.1 Possible XSS in Ticket Actions 0.4%
• CVE-2022-4427 Medium 6.5 SQL Injection via OTRS Search API 0.8%
• CVE-2022-39052 High 7.5 DoS attack using email 0.8%
• CVE-2022-39051 Medium 6.8 Perl Code execution in Template Toolkit 0.8%
• CVE-2022-39050 Medium 4.6 Possible XSS stored in customer information 0.6%
• CVE-2022-39049 Low 3.5 Possible XSS in Admin Interface 0.7%
• CVE-2021-36100 Medium 6.4 Authenticated remote code execution 1.3%
• CVE-2021-36096 Medium 5.2 Support Bundle includes S/Mime and PGP secret or PIN 0.4%
• CVE-2021-36095 Medium 5.3 User enumeration issue using "lost password" feature 0.9%
• CVE-2021-36094 Medium 5.7 XSS attack in appointment edit popup screen 0.6%
• CVE-2021-36093 Medium 5.3 DoS attack using PostMaster filters 1.1%
• CVE-2021-36092 Medium 6.5 XSS attack using special link in email 0.7%
• CVE-2021-36091 Low 3.5 Unautorized access to the calendar appointments 0.7%
• CVE-2021-21443 Low 3.5 Unautorized listing of the customer user emails 0.8%
• CVE-2021-21440 Medium 5.2 Support Bundle includes S/Mime and PGP keys 0.8%
• CVE-2021-21441 High 7.5 XSS in the ticket overview screens 1.1%
• CVE-2021-21439 Medium 6.5 Possible DoS attack using a special crafted URL in email body 0.9%
• CVE-2020-1776 Low 3.5 Invalidating or changing user does not invalidate session 0.9%
• CVE-2020-1774 Medium 4.5 Information disclosure 0.9%
• CVE-2020-1773 High 7.3 Session / Password / Password token leak 1.5%
• CVE-2020-1772 Medium 6.5 Information Disclosure 1.6%
• CVE-2020-1771 Medium 4.6 Possible XSS in Customer user address book 1.0%
• CVE-2020-1770 Low 2.4 Information disclosure in support bundle files 1.3%
• CVE-2020-1769 Low 3.5 Autocomplete in the form login screens 1.2%
• CVE-2020-1767 Low 3.5 Possible to send drafted messages as wrong agent 1.2%
• CVE-2020-1766 Low 2.0 Improper handling of uploaded inline images 1.2%
• CVE-2020-1765 Low 3.5 Spoofing of From field in several screens 1.5%