Log in Start free

osTicket

Products

ProductCVEsExploitedLatest
osticket/osticket7–Mar 10, 2023
osTicket2–Jul 17, 2026

Exploited and recent CVEs

  • CVE-2026-14871 High 7.1 osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure 0.4%
  • CVE-2026-36214 Medium 6.4 osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote 0.4%
  • CVE-2023-1318 Medium 5.4 Cross-site Scripting (XSS) - Generic in osticket/osticket 1.0%
  • CVE-2023-1319 Medium 4.8 Cross-site Scripting (XSS) - Stored in osticket/osticket 0.5%
  • CVE-2023-1317 Medium 5.4 Cross-site Scripting (XSS) - Reflected in osticket/osticket 1.0%
  • CVE-2023-1315 Medium 5.4 Cross-site Scripting (XSS) - Reflected in osticket/osticket 1.1%
  • CVE-2023-1316 Medium 4.5 Cross-site Scripting (XSS) - Stored in osticket/osticket 0.5%
  • CVE-2023-1320 High 7.1 Cross-site Scripting (XSS) - Stored in osticket/osticket 0.6%
  • CVE-2022-4271 High 8.0 Cross-site Scripting (XSS) - Reflected in osticket/osticket 0.7%