RT
Product
Request Tracker
33
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 7Medium 12Low 1
Watch
Add Request Tracker to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44231 | 9.1 | Jul 20 | RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint Affected: before 5.0.10; 6.0.0 before 6.0.3 |
| CVE-2017-5944 | 8.8 | Jul 3 | The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2017-5943 | 8.8 | Jul 3 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF)… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2023-45024 | 7.5 | Nov 3 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder Affected: 5.0.0 before 5.0.5 |
| CVE-2023-41260 | 7.5 | Nov 3 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls Affected: before 4.4.7; 5.0.0 before 5.0.5 |
| CVE-2023-41259 | 7.5 | Nov 3 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST… Affected: before 4.4.7; 5.0.0 before 5.0.5 |
| CVE-2021-38562 | 7.5 | Oct 18 | Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against… Affected: 4.2.0 before 4.2.17; 4.4.0 before 4.4.5; 5.0.0 before 5.0.2 |
| CVE-2018-18898 | 7.5 | Mar 17 | The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address… Affected: 4.1.13 through 4.4.0 |
| CVE-2026-44230 | 6.1 | Jul 20 | RT: Reflected Cross-Site Scripting in search results chart Affected: 5.0.4 before 5.0.10; 6.0.0 before 6.0.3 |
| CVE-2026-44227 | 6.1 | Jul 20 | RT: Reflected Cross-Site Scripting via URL parameters Affected: 6.0.0 before 6.0.3 |
| CVE-2026-6841 | 6.1 | May 21 | Reflected XSS in Request Tracker Affected: 5.0.4 before 5.0.10; 6.0.0 before 6.0.3 |
| CVE-2025-31501 | 6.1 | May 28 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink Affected: 4.4.0 before 4.4.8; 5.0.0 before 5.0.8 |
| CVE-2025-30087 | 6.1 | May 28 | Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL Affected: 4.4.0 before 4.4.8; 5.0.0 before 5.0.8 |
| CVE-2025-31500 | 6.1 | May 28 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name Affected: 5.0.0 before 5.0.8 |
| CVE-2022-25803 | 6.1 | Jul 14 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search Affected: before 5.0.3 |
| CVE-2022-25802 | 6.1 | Jul 14 | Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment Affected: before 4.4.6; 5.0.0 before 5.0.3 |
| CVE-2016-6127 | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2017-5361 | 5.9 | Jul 3 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2026-44229 | 5.4 | Jul 20 | RT: Cross-Site Scripting via inline-served uploaded content Affected: 5.0.0 before 5.0.10; 6.0.0 before 6.0.3 |
| CVE-2026-44228 | 5.4 | Jul 20 | RT: Stored Cross-Site Scripting via insufficient template escaping Affected: 6.0.0 before 6.0.3 |
| CVE-2025-61873 | 2.6 | Jan 16 | Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used Affected: before 4.4.9; 5.0 before 5.0.9; 6.0 before 6.0.2 |
| CVE-2015-6506 | – | Sep 3 | Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a… Affected: through 4.2.11 |
| CVE-2015-5475 | – | Aug 14 | Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to… Affected: through 4.2.11 |
| CVE-2015-1464 | – | Mar 9 | RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL Affected: through 4.0.22; 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; +5 more |
| CVE-2015-1165 | – | Mar 9 | RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors Affected: 3.8.8; 3.8.9; 3.8.10; 3.8.11; 3.8.12; 3.8.13; +34 more |
| CVE-2014-9472 | – | Mar 9 | The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to cause a denial of service (CPU and disk… Affected: 3.6.8; 3.6.10; 3.6.11; 3.8.3; 3.8.4; 3.8.7; +34 more |
| CVE-2013-3737 | – | Nov 16 | The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +7 more |
| CVE-2013-3736 | – | May 5 | Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13 allows remote attackers to… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +7 more |
| CVE-2012-6581 | – | Jul 24 | Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the… Affected: 3.8.3; 3.8.4; 3.8.7; 3.8.9; 3.8.10; 3.8.11; +11 more |
| CVE-2012-6580 | – | Jul 24 | Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, does not ensure that the UI labels unencrypted messages as unencrypted, which might… Affected: 3.8.3; 3.8.4; 3.8.7; 3.8.9; 3.8.10; 3.8.11; +11 more |
| CVE-2012-6579 | – | Jul 24 | Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to configure encryption or signing for certain outbound… Affected: 3.8.3; 3.8.4; 3.8.7; 3.8.9; 3.8.10; 3.8.11; +11 more |
| CVE-2012-6578 | – | Jul 24 | Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled with a "Sign by default" queue configuration, uses a queue's key for signing, which… Affected: 3.8.3; 3.8.4; 3.8.7; 3.8.9; 3.8.10; 3.8.11; +11 more |
| CVE-2013-3525 | – | May 10 | SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter Affected: through 4.0.9; 3.6.8; 3.6.10; 3.6.11; 3.8.3; 3.8.4; +18 more |
Showing 33