BE
Vendor
bestpractical
85
CVEs
0
On KEV
0
New 30D
Products
RT9.1
rt
bestpractical
48 CVEs0 on KEV0 new
RT9.1
Request Tracker
bestpractical
33 CVEs0 on KEV0 new
RT9.1
Request Tracker For Incident Response
Bestpractical
2 CVEs0 on KEV0 new
RT–
Rt-extension-mobileui
Bestpractical
1 CVEs0 on KEV0 new
RT–
Rtfm
Bestpractical
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-44230 | RT rt bestpractical | 6.1 | Jul 20 | RT: Reflected Cross-Site Scripting in search results chart |
| CVE-2026-44231 | RT rt bestpractical | 9.1 | Jul 20 | RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint |
| CVE-2026-44229 | RT rt bestpractical | 5.4 | Jul 20 | RT: Cross-Site Scripting via inline-served uploaded content |
| CVE-2026-44228 | RT rt bestpractical | 5.4 | Jul 20 | RT: Stored Cross-Site Scripting via insufficient template escaping |
| CVE-2026-44227 | RT rt bestpractical | 6.1 | Jul 20 | RT: Reflected Cross-Site Scripting via URL parameters |
| CVE-2026-41076 | RT rt bestpractical | 8.1 | May 22 | RT: LDAP authentication bypass via empty password |
| CVE-2026-41075 | RT rt bestpractical | 8.8 | May 22 | RT: SQL injection via entry_aggregator parameter in JSON search |
| CVE-2026-41074 | RT rt bestpractical | 7.1 | May 22 | RT has broken CSRF protection for authenticated users |
| CVE-2026-41073 | RT rt bestpractical | 4.6 | May 22 | RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps |
| CVE-2026-6841 | RT Request Tracker Bestpractical | 6.1 | May 21 | Reflected XSS in Request Tracker |
| CVE-2025-61873 | RT Request Tracker bestpractical | 2.6 | Jan 16 | Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used |
| CVE-2025-30087 | RT RT bestpractical | 6.1 | May 28 | Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL |
| CVE-2025-31501 | RT RT bestpractical | 6.1 | May 28 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink |
| CVE-2025-31500 | RT RT bestpractical | 6.1 | May 28 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name |
| CVE-2023-45024 | RT Request Tracker Bestpractical | 7.5 | Nov 3 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder |
| CVE-2023-41260 | RT Request Tracker Bestpractical | 7.5 | Nov 3 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls |
| CVE-2023-41259 | RT Request Tracker Bestpractical | 7.5 | Nov 3 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST… |
| CVE-2022-25803 | RT Request Tracker Bestpractical | 6.1 | Jul 14 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search |
| CVE-2022-25802 | RT Request Tracker Bestpractical | 6.1 | Jul 14 | Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment |
| CVE-2022-25801 | RT Request Tracker For Incident Response Bestpractical | 9.1 | Jul 14 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools |
| CVE-2022-25800 | RT Request Tracker For Incident Response Bestpractical | 9.1 | Jul 14 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool |
| CVE-2021-38562 | RT Request Tracker Bestpractical | 7.5 | Oct 18 | Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against… |
| CVE-2018-18898 | RT Request Tracker Bestpractical | 7.5 | Mar 17 | The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address… |
| CVE-2017-5944 | RT Request Tracker Bestpractical | 8.8 | Jul 3 | The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain… |
| CVE-2017-5943 | RT Request Tracker Bestpractical | 8.8 | Jul 3 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF)… |
| CVE-2017-5361 | RT Request Tracker Bestpractical | 5.9 | Jul 3 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote… |
| CVE-2016-6127 | RT Request Tracker Bestpractical | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting… |
| CVE-2015-6506 | RT Request Tracker Bestpractical | – | Sep 3 | Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a… |
| CVE-2015-5475 | RT Request Tracker Bestpractical | – | Aug 14 | Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to… |
| CVE-2015-1464 | RT Request Tracker Bestpractical | – | Mar 9 | RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL |
| CVE-2015-1165 | RT Request Tracker Bestpractical | – | Mar 9 | RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors |
| CVE-2014-9472 | RT Request Tracker Bestpractical | – | Mar 9 | The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to cause a denial of service (CPU and disk… |
| CVE-2013-3737 | RT Request Tracker Bestpractical | – | Nov 16 | The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and… |
| CVE-2014-1474 | RT RT Bestpractical | – | Jul 15 | Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption)… |
| CVE-2013-3736 | RT Rt-extension-mobileui Bestpractical | – | May 5 | Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13 allows remote attackers to… |
| CVE-2013-5587 | RT RT Bestpractical | – | Aug 23 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML… |
| CVE-2013-3374 | RT RT Bestpractical | – | Aug 23 | Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to… |
| CVE-2013-3373 | RT RT Bestpractical | – | Aug 23 | CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response… |
| CVE-2013-3372 | RT RT Bestpractical | – | Aug 23 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site… |
| CVE-2013-3371 | RT RT Bestpractical | – | Aug 23 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via… |
| CVE-2013-3370 | RT RT Bestpractical | – | Aug 23 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an… |
| CVE-2013-3369 | RT RT Bestpractical | – | Aug 23 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary… |
| CVE-2013-3368 | RT RT Bestpractical | – | Aug 23 | bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with… |
| CVE-2012-4733 | RT RT Bestpractical | – | Aug 23 | Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the… |
| CVE-2012-6581 | RT Request Tracker Bestpractical | – | Jul 24 | Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the… |
| CVE-2012-6580 | RT Request Tracker Bestpractical | – | Jul 24 | Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, does not ensure that the UI labels unencrypted messages as unencrypted, which might… |
| CVE-2012-6579 | RT Request Tracker Bestpractical | – | Jul 24 | Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to configure encryption or signing for certain outbound… |
| CVE-2012-6578 | RT Request Tracker Bestpractical | – | Jul 24 | Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled with a "Sign by default" queue configuration, uses a queue's key for signing, which… |
| CVE-2013-3525 | RT Request Tracker Bestpractical | – | May 10 | SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter |
| CVE-2012-4884 | RT RT Bestpractical | – | Nov 11 | Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors… |
| CVE-2012-4734 | RT RT Bestpractical | – | Nov 11 | Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and… |
| CVE-2012-4732 | RT RT Bestpractical | – | Nov 11 | Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers… |
| CVE-2012-4731 | RT Rtfm Bestpractical | – | Nov 11 | FAQ manager for Request Tracker (RTFM) before 2.4.5 does not properly check user rights, which allows remote authenticated users to create arbitrary articles in arbitrary classes… |
| CVE-2012-4730 | RT RT Bestpractical | – | Nov 11 | Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and… |
| CVE-2011-5093 | RT RT Bestpractical | – | Jun 4 | Best Practical Solutions RT 4.x before 4.0.6 does not properly implement the DisallowExecuteCode option, which allows remote authenticated users to bypass intended access… |
| CVE-2011-5092 | RT RT Bestpractical | – | Jun 4 | Best Practical Solutions RT 3.8.x before 3.8.12 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code and gain privileges via unspecified vectors, a different… |
| CVE-2011-4460 | RT RT Bestpractical | – | Jun 4 | SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by… |
| CVE-2011-4459 | RT RT Bestpractical | – | Jun 4 | Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions… |
| CVE-2011-4458 | RT RT Bestpractical | – | Jun 4 | Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute… |
| CVE-2011-2085 | RT RT Bestpractical | – | Jun 4 | Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of… |