https://vulnogram.org/ Most recent CVEs assigned by EasyVista-OTRS GmbH (otrs). https://vulnogram.org/seaview/icons/otrs.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-93582 https://vulnogram.org/CVE-2026-93582 The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be… Critical Network Exploitable Mon, 12 Oct 2026 06:49:38 GMT https://vulnogram.org/CVE-2026-93581 https://vulnogram.org/CVE-2026-93581 User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored… Medium Network Exploitable Mon, 12 Oct 2026 06:49:31 GMT https://vulnogram.org/CVE-2026-78359 https://vulnogram.org/CVE-2026-78359 OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresse… Medium Mon, 12 Oct 2026 06:49:24 GMT https://vulnogram.org/CVE-2026-78358 https://vulnogram.org/CVE-2026-78358 Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeTok… Medium Network Exploitable Mon, 12 Oct 2026 06:49:18 GMT https://vulnogram.org/CVE-2026-78357 https://vulnogram.org/CVE-2026-78357 Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can… Critical Network Exploitable Mon, 12 Oct 2026 06:49:10 GMT https://vulnogram.org/CVE-2026-78356 https://vulnogram.org/CVE-2026-78356 The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed i… Medium Network Exploitable Mon, 12 Oct 2026 06:49:04 GMT https://vulnogram.org/CVE-2026-78355 https://vulnogram.org/CVE-2026-78355 A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. Th… High Mon, 12 Oct 2026 06:48:56 GMT https://vulnogram.org/CVE-2026-48212 https://vulnogram.org/CVE-2026-48212 An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X… Medium Mon, 12 Oct 2026 06:48:50 GMT https://vulnogram.org/CVE-2026-48211 https://vulnogram.org/CVE-2026-48211 An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allow… Medium Network Exploitable Mon, 12 Oct 2026 06:48:42 GMT https://vulnogram.org/CVE-2026-48187 https://vulnogram.org/CVE-2026-48187 An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This issue affects OTRS: * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X befor… Medium Mon, 01 Jun 2026 03:33:23 GMT https://vulnogram.org/CVE-2026-48188 https://vulnogram.org/CVE-2026-48188 An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server… Critical Network Exploitable Mon, 01 Jun 2026 03:33:15 GMT https://vulnogram.org/CVE-2026-48189 https://vulnogram.org/CVE-2026-48189 An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note that the feature has to be anabled and CustomerGroupSupport has to be used to be affect… Medium Mon, 01 Jun 2026 03:33:03 GMT https://vulnogram.org/CVE-2026-48190 https://vulnogram.org/CVE-2026-48190 An incorrect handling of permissions in OTRS External Interface and the ConfigItem List module allows an authenticated customer to query the system for CI information. Please note that CMDB has to be anabled and CustomerGroupSupport has to be used to… Low Mon, 01 Jun 2026 03:32:53 GMT https://vulnogram.org/CVE-2026-48191 https://vulnogram.org/CVE-2026-48191 An incorrect handling of permissions in STORM powered by OTRS and in OTRS (2026.x and above) Document Search Article Meta Filters modules allows gaining knowledge about number of affected CIs, SLA and services without gaining access to them. This iss… Low Mon, 01 Jun 2026 03:32:47 GMT https://vulnogram.org/CVE-2026-48208 https://vulnogram.org/CVE-2026-48208 An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of ser… Medium Network Exploitable Mon, 01 Jun 2026 03:32:38 GMT https://vulnogram.org/CVE-2026-48209 https://vulnogram.org/CVE-2026-48209 An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS) attacks via crafted request parameters associated with ticket a… High Network Exploitable Mon, 01 Jun 2026 03:32:28 GMT https://vulnogram.org/CVE-2026-48210 https://vulnogram.org/CVE-2026-48210 An improper default configuration in OTRS 2026.3.1 causes ticket article forwarding actions to enforce the “Is visible for customer” flag by default and prevent users from disabling it via the UI. This leads to unintended exposure of internal ticket… Medium Sun, 31 May 2026 21:11:25 GMT https://vulnogram.org/CVE-2026-6060 https://vulnogram.org/CVE-2026-6060 A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a DoS against the webserver. will be killed by the systemThis issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026… Medium Mon, 20 Apr 2026 18:20:01 GMT https://vulnogram.org/CVE-2025-24391 https://vulnogram.org/CVE-2025-24391 A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses. This… Medium Network Exploitable Mon, 14 Jul 2025 08:15:58 GMT https://vulnogram.org/CVE-2025-24388 https://vulnogram.org/CVE-2025-24388 A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin user. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025… Low Mon, 16 Jun 2025 11:29:20 GMT https://vulnogram.org/CVE-2025-24387 https://vulnogram.org/CVE-2025-24387 A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, per… Medium Mon, 10 Mar 2025 09:28:31 GMT https://vulnogram.org/CVE-2025-24390 https://vulnogram.org/CVE-2025-24390 A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X Medium Mon, 27 Jan 2025 05:59:20 GMT https://vulnogram.org/CVE-2025-24389 https://vulnogram.org/CVE-2025-24389 Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X *… Medium Mon, 27 Jan 2025 05:59:01 GMT https://vulnogram.org/CVE-2024-43446 https://vulnogram.org/CVE-2024-43446 An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Communit… Low Mon, 27 Jan 2025 05:58:29 GMT https://vulnogram.org/CVE-2024-43445 https://vulnogram.org/CVE-2024-43445 A vulnerability exists in OTRS and ((OTRS Community Edition)) that fail to set the HTTP response header X-Content-Type-Options to nosniff. An attacker could exploit this vulnerability by uploading or inserting content that would be treated as a diffe… Medium Network Exploitable Mon, 27 Jan 2025 05:58:11 GMT https://vulnogram.org/CVE-2024-43444 https://vulnogram.org/CVE-2024-43444 Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: * OTRS… High Network Exploitable Mon, 26 Aug 2024 08:42:58 GMT https://vulnogram.org/CVE-2024-43443 https://vulnogram.org/CVE-2024-43443 Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in Process Management modules of OTRS and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the Process Management targeting other a… Medium Mon, 26 Aug 2024 08:42:55 GMT https://vulnogram.org/CVE-2024-43442 https://vulnogram.org/CVE-2024-43442 Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site Scripting') in OTRS (System Configuration modules) and ((OTRS)) Community Edition allows Cross-Site Scripting (XSS) within the System Configuration targeting othe… Medium Mon, 26 Aug 2024 08:42:39 GMT https://vulnogram.org/CVE-2024-23794 https://vulnogram.org/CVE-2024-23794 An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instanc… Medium Mon, 15 Jul 2024 07:14:09 GMT https://vulnogram.org/CVE-2024-6540 https://vulnogram.org/CVE-2024-6540 Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem onl… Medium Mon, 15 Jul 2024 07:13:49 GMT https://vulnogram.org/CVE-2024-23793 https://vulnogram.org/CVE-2024-23793 The file upload feature in OTRS and ((OTRS)) Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially… Medium Thu, 06 Jun 2024 18:06:58 GMT https://vulnogram.org/CVE-2024-23790 https://vulnogram.org/CVE-2024-23790 Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes. This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.… Low Mon, 29 Jan 2024 09:21:14 GMT https://vulnogram.org/CVE-2024-23791 https://vulnogram.org/CVE-2024-23791 Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1. Medium Mon, 29 Jan 2024 09:21:00 GMT https://vulnogram.org/CVE-2024-23792 https://vulnogram.org/CVE-2024-23792 When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user. The attack requires a logged-in other user to know the UUID. While the legitimate user completes the comment, the malicious user can… Medium Mon, 29 Jan 2024 09:20:06 GMT https://vulnogram.org/CVE-2023-6254 https://vulnogram.org/CVE-2023-6254 A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue affects OTRS: from 8.0.X through 8.0.37. High Mon, 27 Nov 2023 09:44:00 GMT https://vulnogram.org/CVE-2023-5421 https://vulnogram.org/CVE-2023-5421 An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configurati… Low Mon, 16 Oct 2023 08:10:55 GMT https://vulnogram.org/CVE-2023-38059 https://vulnogram.org/CVE-2023-38059 The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload. This can be used to retreive the IP of the user.This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37;… Medium Network Exploitable Mon, 16 Oct 2023 08:10:44 GMT https://vulnogram.org/CVE-2023-5422 https://vulnogram.org/CVE-2023-5422 The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured… High Network Exploitable Mon, 16 Oct 2023 08:10:35 GMT https://vulnogram.org/CVE-2023-38060 https://vulnogram.org/CVE-2023-38060 Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any authenticated attacker to to perform an host header injection for the Con… Medium Mon, 24 Jul 2023 08:28:13 GMT https://vulnogram.org/CVE-2023-38058 https://vulnogram.org/CVE-2023-38058 An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the needed permission. This issue affects OTRS: from 8.0.X before 8.0.35. Medium Mon, 24 Jul 2023 08:28:03 GMT https://vulnogram.org/CVE-2023-38057 https://vulnogram.org/CVE-2023-38057 An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the rep… Medium Mon, 24 Jul 2023 08:27:55 GMT https://vulnogram.org/CVE-2023-38056 https://vulnogram.org/CVE-2023-38056 Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g. SchedulerCronTaskModule using UnitTests modules allows any authenticated attacker with admin privileges local execution of Code.This issue affects OTRS: fro… High Mon, 24 Jul 2023 08:27:13 GMT https://vulnogram.org/CVE-2023-2534 https://vulnogram.org/CVE-2023-2534 Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into overall system usage. User IDs can easily be correlated with real names e.… High Mon, 08 May 2023 07:29:49 GMT https://vulnogram.org/CVE-2023-1250 https://vulnogram.org/CVE-2023-1250 Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated c… High Mon, 20 Mar 2023 08:20:39 GMT https://vulnogram.org/CVE-2023-1248 https://vulnogram.org/CVE-2023-1248 Improper Input Validation vulnerability in OTRS AG OTRS (Ticket Actions modules), OTRS AG ((OTRS)) Community Edition (Ticket Actions modules) allows Cross-Site Scripting (XSS).This issue affects OTRS: from 7.0.X before 7.0.42; ((OTRS)) Community Edit… Medium Network Exploitable Mon, 20 Mar 2023 08:19:34 GMT https://vulnogram.org/CVE-2022-4427 https://vulnogram.org/CVE-2022-4427 Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Communi… Medium Mon, 19 Dec 2022 08:09:51 GMT https://vulnogram.org/CVE-2022-3501 https://vulnogram.org/CVE-2022-3501 Article template contents with sensitive data could be accessed from agents without permissions. Low Mon, 17 Oct 2022 08:55:11 GMT https://vulnogram.org/CVE-2022-39052 https://vulnogram.org/CVE-2022-39052 An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system High Network Exploitable Mon, 17 Oct 2022 08:55:10 GMT https://vulnogram.org/CVE-2022-39051 https://vulnogram.org/CVE-2022-39051 Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package Medium Mon, 05 Sep 2022 06:40:12 GMT https://vulnogram.org/CVE-2022-39050 https://vulnogram.org/CVE-2022-39050 An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The… Medium Mon, 05 Sep 2022 06:40:11 GMT