Skip to content
Noroxi

otrs records

161 published records for vendor otrs.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
7
With a fix record
68.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

161 records
  • CVE-2017-16921
    41Plan

    In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who i

    HighCVSS 8.8Proof of conceptEPSS 19%

    otrs · otrsDec 8, 2017

  • CVE-2022-4427
    39Monitor

    SQL Injection via OTRS Search API

    CriticalCVSS 9.8No exploitEPSS 0%

    otrs · otrsDec 19, 2022

  • CVE-2024-23790
    39Monitor

    Missing file type check in avatar picture upload

    CriticalCVSS 9.8No exploitEPSS 0%

    otrs · otrsJan 29, 2024

  • CVE-2016-5843
    38Monitor

    Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request Sy

    CriticalCVSS 9.4No exploitEPSS 3%

    otrs · faqSep 16, 2016

  • CVE-2017-16664
    36Monitor

    Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3

    HighCVSS 8.8No exploitEPSS 2%

    otrs · otrsNov 21, 2017

  • CVE-2017-9324
    36Monitor

    In Open Ticket Request System (OTRS) 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is

    HighCVSS 8.8No exploitEPSS 2%

    otrs · otrsJun 12, 2017

  • CVE-2017-17476
    36Monitor

    Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might a

    HighCVSS 8.8No exploitEPSS 2%

    otrs · otrsDec 20, 2017

  • CVE-2017-14635
    36Monitor

    In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage

    HighCVSS 8.8No exploitEPSS 1%

    otrs · otrsSep 21, 2017

  • CVE-2018-14593
    36Monitor

    An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30.

    HighCVSS 8.8No exploitEPSS 1%

    otrs · open ticket request systemAug 3, 2018

  • CVE-2017-15864
    36Monitor

    In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like

    HighCVSS 8.8No exploitEPSS 1%

    otrs · otrsNov 16, 2017

  • CVE-2026-48188
    36Monitor

    SQL Injection via MySQL Quote Method

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    otrs · otrsJun 1, 2026

  • CVE-2023-5422
    36Monitor

    SSL Certificates are not checked for E-Mail Handling

    CriticalCVSS 9.1No exploitEPSS 0%

    otrs · otrsOct 16, 2023

  • CVE-2013-4717
    35Monitor

    Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x be

    HighCVSS 8.8No exploitEPSS 1%

    otrs · otrsAug 9, 2021

  • CVE-2021-36100
    35Monitor

    Authenticated remote code execution

    HighCVSS 8.8No exploitEPSS 1%

    otrs · otrsMar 21, 2022

  • CVE-2022-39051
    35Monitor

    Perl Code execution in Template Toolkit

    HighCVSS 8.8No exploitEPSS 0%

    otrs · otrsSep 5, 2022

  • CVE-2023-38060
    35Monitor

    Host header injection by attachments in web service

    HighCVSS 8.8No exploitEPSS 0%

    otrs · otrsJul 24, 2023

  • CVE-2005-3893
    32Monitor

    Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow re

    HighCVSS 7.5Proof of conceptEPSS 7%

    otrs · otrsNov 29, 2005

  • CVE-2020-1773
    32Monitor

    Session / Password / Password token leak

    HighCVSS 8.1No exploitEPSS 1%

    otrs · otrsMar 27, 2020

  • CVE-2023-2534
    32Monitor

    Information disclouse and DoS via websocket push events

    HighCVSS 8.1No exploitEPSS 0%

    otrs · otrsMay 8, 2023

  • CVE-2024-43444
    32Monitor

    Passwords are written to Admin Log Module

    HighCVSS 8.2No exploitEPSS 0%

    otrs ag · otrsAug 26, 2024

  • CVE-2011-0456
    31Monitor

    webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified ve

    HighCVSS 7.5No exploitEPSS 3%

    otrs · otrsMar 11, 2011

  • CVE-2019-18180
    31Monitor

    Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g.

    HighCVSS 7.5No exploitEPSS 2%

    otrs · otrsDec 5, 2019

  • CVE-2014-1471
    31Monitor

    SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before

    HighCVSS 7.5No exploitEPSS 1%

    otrs · otrsFeb 4, 2014

  • CVE-2023-1250
    31Monitor

    Code execution through ACL creation

    HighCVSS 7.8No exploitEPSS 0%

    otrs · otrsMar 20, 2023

  • CVE-2018-7567
    30Monitor

    In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are abl

    HighCVSS 7.2No exploitEPSS 5%

    otrs · otrsMar 4, 2018