← Back

Enhancesoft

enhancesoft

47 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Osticket
osticket
45 CVEs
Audit Log
audit_log
2 CVEs

CVEs (47)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-26895
1Enhancesoft
1Osticket
Jul 24, 2026
Apr 2, 2026
N/A· v4
5.3 MEDIUM· v3
N/A· v2
User enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the platform.
CVE-2026-22200
1Enhancesoft
1Osticket
Jul 14, 2026
Jan 12, 2026
8.7 HIGH· v4
7.5 HIGH· v3
N/A· v2
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafte...Show more
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.Show less
CVE-2025-26241
2Enhancesoft
Osticket
2Osticket
Osticket
Jul 10, 2026
May 5, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters com...Show more
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.Show less
CVE-2023-46967
1Enhancesoft
1Osticket
Jun 17, 2026
Feb 20, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket.
CVE-2023-27149
1Enhancesoft
1Osticket
Jun 17, 2026
Oct 23, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a cu...Show more
A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Label input parameter when updating a custom list.Show less
CVE-2023-27148
1Enhancesoft
1Osticket
Jun 17, 2026
Oct 23, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter.
CVE-2021-45811
1Enhancesoft
1Osticket
Jul 9, 2026
Sep 8, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combi...Show more
A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.Show less
CVE-2023-30082
1Enhancesoft
1Osticket
Jun 17, 2026
Jun 14, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop r...Show more
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is entered, this procedure will consume all available CPU and memory.Show less
CVE-2022-31890
1Enhancesoft
1Audit Log
Jun 17, 2026
Apr 5, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function.
CVE-2022-31889
1Enhancesoft
1Audit Log
Jun 17, 2026
Apr 5, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae.
CVE-2022-31888
1Enhancesoft
1Osticket
Jun 17, 2026
Apr 5, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
CVE-2023-1320
1Enhancesoft
1Osticket
Jun 17, 2026
Mar 10, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
CVE-2023-1319
1Enhancesoft
1Osticket
Jun 17, 2026
Mar 10, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
CVE-2023-1318
1Enhancesoft
1Osticket
Jun 17, 2026
Mar 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.
CVE-2023-1317
1Enhancesoft
1Osticket
Jun 17, 2026
Mar 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
CVE-2023-1316
1Enhancesoft
1Osticket
Jun 17, 2026
Mar 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
CVE-2023-1315
1Enhancesoft
1Osticket
Jun 17, 2026
Mar 10, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
CVE-2022-4271
1Enhancesoft
1Osticket
Jun 17, 2026
Dec 2, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4.
CVE-2022-32074
2Enhancesoft
Osticket
2Osticket
Osticket
Jul 10, 2026
Jul 13, 2022
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web s...Show more
A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.Show less
CVE-2021-42235
1Enhancesoft
1Osticket
Jun 17, 2026
May 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.