21 results · Feed
-
High 8.6
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQ…
-
Critical 9.5
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensi…
-
Medium 4.8
Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.
-
Medium 6.4
In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communicati…
-
Medium 5.4
In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.
-
Critical 9.1CVE-2026-48188 Public exploit
SQL Injection via MySQL Quote Method
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is config…
-
Medium 6.1CVE-2025-52204 Public exploit
A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomer…
-
Critical 9.8
An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to…
-
Critical 9.8
An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can u…
-
Critical 9.1
An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked.
-
Critical 9.8
An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.
-
High 7.5
An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-m…
-
Medium 6.1
An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences Update…
-
Medium 6.1
jquery-validation vulnerable to Cross-site Scripting
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a u…
-
Critical 9.8
canvg Prototype Pollution vulnerability
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
-
Medium 6.1
Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of …
-
High 7.5
Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email. Parsing the content of email…
-
High 8.8
An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in agent is able…
-
Critical 9.8
An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in us…
-
Medium 6.3
Host header injection by attachments in web service
Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the ContentType …
-
Medium 6.5
SQL Injection via OTRS Search API
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Editio…