OTRS AG OTRS

• CVE-2026-48187 Medium 5.7 Email with special content can lead to DoS 0.2%
• CVE-2026-48188 Critical 9.1 SQL Injection via MySQL Quote Method 0.7%
• CVE-2026-48189 Medium 5.7 Bypass DedicatedAgentToCustomerGroups Setting 0.2%
• CVE-2026-48190 Low 3.5 Incorrect handling of permissions in External Interface Config Item List module 0.1%
• CVE-2026-48191 Low 3.5 Wrong Permission Handling in Document Search Article Meta Filters 0.1%
• CVE-2026-48208 Medium 6.5 Denial-of-Service via SVG Rendering in Ticket 0.3%
• CVE-2026-48209 High 7.1 Reflected XSS in authenticated agent context 0.2%
• CVE-2026-48210 Medium 5.7 Possible information disclosure via External Interface 0.2%
• CVE-2026-6060 Medium 4.5 Possible DoS via SQL Box 0.2%
• CVE-2025-24391 Medium 5.3 Possible user enumeration 0.3%
• CVE-2025-24388 Low 3.8 Unsafe handling of AJAX calls 0.3%
• CVE-2025-24387 Medium 4.8 Missing CSRF protection 0.2%
• CVE-2025-24390 Medium 6.8 Missing Cookie Flags 0.2%
• CVE-2025-24389 Medium 6.3 SMTP Password will be shown in cleartext on some SMTP errors 0.1%
• CVE-2024-43446 Low 3.5 Improper check of permissions in Generic Interface 0.2%
• CVE-2024-43445 Medium 5.4 Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing 0.2%
• CVE-2024-43444 High 8.2 Passwords are written to Admin Log Module 0.4%
• CVE-2024-43443 Medium 4.9 Stored XSS in process management 0.4%
• CVE-2024-43442 Medium 4.9 Stored XSS in System Configuration 0.4%
• CVE-2024-23794 Medium 5.2 Agents are able to lock the ticket without the "Owner" permission 0.3%
• CVE-2024-6540 Medium 5.7 Information exlosure in external interface 0.4%
• CVE-2024-23793 Medium 6.3 Upload of files outside application directory 0.8%
• CVE-2024-23790 Low 3.5 Missing file type check in avatar picture upload 0.3%
• CVE-2024-23791 Medium 4.9 Unnecessary data is written to log if issues during indexing occurs 0.5%
• CVE-2024-23792 Medium 5.3 Insufficient access control 0.3%
• CVE-2023-6254 High 8.1 Password is send back to client 0.6%
• CVE-2023-5421 Low 3.5 Possible XSS execution in customer information 0.4%
• CVE-2023-38059 Medium 5.3 External pictures can be loaded even if not allowed by configuration 0.5%
• CVE-2023-5422 High 8.7 SSL Certificates are not checked for E-Mail Handling 0.3%
• CVE-2023-38060 Medium 6.3 Host header injection by attachments in web service 0.7%
• CVE-2023-38058 Medium 4.1 Tickets can be moved without permissions 0.4%
• CVE-2023-38057 Medium 4.1 XSS stored in survey answers 0.4%
• CVE-2023-38056 High 7.2 Code execution via System Configuration 0.9%
• CVE-2023-2534 High 7.6 Information disclouse and DoS via websocket push events 0.5%
• CVE-2023-1250 High 7.4 Code execution through ACL creation 0.3%
• CVE-2023-1248 Medium 6.1 Possible XSS in Ticket Actions 0.4%
• CVE-2022-4427 Medium 6.5 SQL Injection via OTRS Search API 0.8%
• CVE-2022-39052 High 7.5 DoS attack using email 0.8%
• CVE-2022-39051 Medium 6.8 Perl Code execution in Template Toolkit 0.8%
• CVE-2022-39050 Medium 4.6 Possible XSS stored in customer information 0.6%
• CVE-2022-39049 Low 3.5 Possible XSS in Admin Interface 0.7%
• CVE-2022-32741 Medium 5.3 Information disclosure in Request New Password feature 0.9%
• CVE-2022-32740 Low 3.5 Information disclosure in the External Interface 0.9%
• CVE-2022-32739 Low 3.5 OTRS version number is always in the exported ICS files 0.9%
• CVE-2022-1004 Medium 4.3 Information disclosure in the External Interface 0.6%
• CVE-2022-0475 Low 3.5 Possible XSS attack via translation 0.4%
• CVE-2021-36100 Medium 6.4 Authenticated remote code execution 1.3%
• CVE-2022-0473 Low 3.8 Dynamic field error message is vulnerable to XSS 0.5%
• CVE-2021-36097 Low 3.5 Agents are able to lock the ticket without the "Owner" permission 0.5%
• CVE-2021-36096 Medium 5.2 Support Bundle includes S/Mime and PGP secret or PIN 0.4%