Skip to content
OpenAdvisories

Vendor

osTicket

9 known vulnerabilities.

Products

osticket/osticket 7 osTicket 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-14871 Public exploit

    osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

    osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem.

    osTicket osTicket
  • High 7.1
    CVE-2023-1320

    Cross-site Scripting (XSS) - Stored in osticket/osticket

    Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.

    osTicket osticket/osticket
  • High 8.0
    CVE-2022-4271

    Cross-site Scripting (XSS) - Reflected in osticket/osticket

    Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4.

    osTicket osticket/osticket