CVE Intelligence

Vulnerabilidades do osTicket osTicket

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam osTicket osTicket: 2 registro(s), com versões afetadas e correções.

CVE-2026-14871 Alta · 7.1 CWE-863 17/07/2026
osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.
CVE-2026-36214 Média · 6.4 CWE-79 14/07/2026
Cross-site Scripting (XSS) em osTicket
osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.