Login Request a demo
OT
Vendor
Otrs
15 products with CVEs on record
173
CVEs
0
On KEV
0
New 30D
Products
OT
Otrs
Otrs
9.8
142 CVEs0 on KEV0 new
OI
Otrs Itsm
Otrs
8.8
8 CVEs0 on KEV0 new
OT
Open Ticket Request System
Otrs
8.8
6 CVEs0 on KEV0 new
FA
Faq
Otrs
9.4
4 CVEs0 on KEV0 new
OH
Otrs Help Desk
Otrs
6.5
2 CVEs0 on KEV0 new
SU
Survey
Otrs
5.4
2 CVEs0 on KEV0 new
CR
Calendar Resource Planning
Otrs
5.3
1 CVEs0 on KEV0 new
CI
Cis IN Customer Frontend
Otrs
4.3
1 CVEs0 on KEV0 new
CC
Custom Contact Fields
Otrs
3.5
1 CVEs0 on KEV0 new
IP
Iphonehandle
Otrs
–
1 CVEs0 on KEV0 new
IT
Itsmconfigurationmanagement
Otrs
4.3
1 CVEs0 on KEV0 new
OS
Otrs Storm
Otrs
8.8
1 CVEs0 on KEV0 new
OT
Otrscisincustomerfrontend
Otrs
4.3
1 CVEs0 on KEV0 new
TF
Ticket Forms
Otrs
4.9
1 CVEs0 on KEV0 new
TA
Time Accounting
Otrs
5.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-48187
OT
Otrs
Otrs
5.7
0%
Jun 1Email with special content can lead to DoS
CVE-2026-48188
OT
Otrs
Otrs
9.1
1%
Jun 1SQL Injection via MySQL Quote Method
CVE-2026-48189
OT
Otrs
Otrs
5.7
0%
Jun 1Bypass DedicatedAgentToCustomerGroups Setting
CVE-2026-48190
OT
Otrs
Otrs
3.5
0%
Jun 1Incorrect handling of permissions in External Interface Config Item List module
CVE-2026-48191
OT
Otrs
Otrs
3.5
0%
Jun 1Wrong Permission Handling in Document Search Article Meta Filters
CVE-2026-48208
OT
Otrs
Otrs
6.5
0%
Jun 1Denial-of-Service via SVG Rendering in Ticket
CVE-2026-48209
OT
Otrs
Otrs
7.1
0%
Jun 1Reflected XSS in authenticated agent context
CVE-2026-48210
OT
Otrs
Otrs
5.7
0%
May 31Possible information disclosure via External Interface
CVE-2025-24387
OT
Otrs
Otrs
6.5
0%
Mar 10A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions
CVE-2024-6540
OT
Otrs
Otrs
5.3
0%
Jul 15Improper filtering of fields when using the export function in the ticket overview of the external interface in OTRS could allow an authorized user to download a list of tickets…
CVE-2024-23794
OT
Otrs
Otrs
7.5
0%
Jul 15An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation
CVE-2024-23792
OT
Otrs
Otrs
6.5
0%
Jan 29When adding attachments to ticket comments, another user can add attachments as well impersonating the orginal user
CVE-2024-23791
OT
Otrs
Otrs
7.5
1%
Jan 29Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X…
CVE-2024-23790
OT
Otrs
Otrs
9.8
0%
Jan 29Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes
CVE-2023-6254
OT
Otrs
Otrs
7.5
1%
Nov 27A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server response- This issue…
CVE-2023-5422
OT
Otrs
Otrs
9.1
0%
Oct 16The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication
CVE-2023-5421
OT
Otrs
Otrs
5.5
0%
Oct 16An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs …
CVE-2023-38059
OT
Otrs
Otrs
5.3
1%
Oct 16The loading of external images is not blocked, even if configured, if the attacker uses protocol-relative URL in the payload
CVE-2023-38060
OT
Otrs
Otrs
8.8
1%
Jul 24Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations of the OTRS Generic Interface modules allows any…
CVE-2023-38058
OT
Otrs
Otrs
4.3
0%
Jul 24An improper privilege check in the OTRS ticket move action in the agent interface allows any as agent authenticated attacker to to perform a move of an ticket without the…
CVE-2023-38057
SU
Survey
Otrs
5.4
0%
Jul 24An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text…
CVE-2023-38056
OT
Otrs
Otrs
7.2
1%
Jul 24Improper Neutralization of commands allowed to be executed via OTRS System Configuration e.g
CVE-2023-2534
OT
Otrs
Otrs
8.1
1%
May 8Improper Authorization vulnerability in OTRS AG OTRS 8 (Websocket API backend) allows any as Agent authenticated attacker to track user behaviour and to gain live insight into…
CVE-2018-17883
OT
Otrs
Otrs
6.1
0%
Apr 16An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12
CVE-2023-1250
OT
Otrs
Otrs
7.8
0%
Mar 20Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code
CVE-2023-1248
OT
Otrs
Otrs
6.1
0%
Mar 20Improper Input Validation vulnerability in OTRS AG OTRS (Ticket Actions modules), OTRS AG ((OTRS)) Community Edition (Ticket Actions modules) allows Cross-Site Scripting…
CVE-2022-4427
OT
Otrs
Otrs
9.8
1%
Dec 19Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1…
CVE-2022-3501
OT
Otrs
Otrs
7.5
1%
Oct 17Information exposure of template content due to missing check of permissions
CVE-2022-39052
OT
Otrs
Otrs
6.5
1%
Oct 17DoS attack using email
CVE-2022-39051
OT
Otrs
Otrs
8.8
1%
Sep 5Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package
CVE-2022-39050
OT
Otrs
Otrs
4.8
1%
Sep 5An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL…
CVE-2022-39049
OT
Otrs
Otrs
4.8
1%
Sep 5An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS
CVE-2022-32741
OT
Otrs
Otrs
5.3
1%
Jun 13Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time
CVE-2022-32740
OT
Otrs
Otrs
5.3
1%
Jun 13A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances
CVE-2022-32739
CR
Calendar Resource Planning
Otrs
5.3
1%
Jun 13When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number
CVE-2022-1004
OT
Otrs
Otrs
4.3
1%
Mar 21Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled
CVE-2022-0475
OT
Otrs
Otrs
5.4
0%
Mar 21Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed)
CVE-2021-36100
OT
Otrs
Otrs
8.8
1%
Mar 21Specially crafted string in OTRS system configuration can allow the execution of any system command
CVE-2022-0474
CC
Custom Contact Fields
Otrs
3.5
1%
Feb 7Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient…
CVE-2022-0473
OT
Otrs
Otrs
4.8
1%
Feb 7OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check
CVE-2021-36097
OT
Otrs
Otrs
4.3
1%
Oct 18Agents are able to lock the ticket without the "Owner" permission
CVE-2021-36096
OT
Otrs
Otrs
4.9
0%
Sep 6Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden
CVE-2021-36095
OT
Otrs
Otrs
5.3
1%
Sep 6Malicious attacker is able to find out valid user logins by using the "lost password" feature
CVE-2021-36094
OT
Otrs
Otrs
5.4
1%
Sep 6It's possible to craft a request for appointment edit screen, which could lead to the XSS attack
CVE-2021-36093
OT
Otrs
Otrs
5.3
1%
Sep 6It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS
CVE-2013-4718
OT
Otrs
Otrs
5.4
1%
Aug 9Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated…
CVE-2013-4717
OT
Otrs
Otrs
8.8
1%
Aug 9Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated…
CVE-2021-36092
OT
Otrs
Otrs
6.1
1%
Jul 26It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack
CVE-2021-36091
OT
Otrs
Otrs
4.3
1%
Jul 26Agents are able to list appointments in the calendars without required permissions
CVE-2021-21443
OT
Otrs
Otrs
4.3
1%
Jul 26Agents are able to list customer user emails without required permissions in the bulk action screen
CVE-2021-21442
TA
Time Accounting
Otrs
5.4
1%
Jul 26In the project create screen it's possible to inject malicious JS code to the certain fields
CVE-2021-21440
OT
Otrs
Otrs
6.5
1%
Jul 26Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden
CVE-2021-21441
OT
Otrs
Otrs
7.5
1%
Jun 16There is a XSS vulnerability in the ticket overview screens
CVE-2021-21439
OT
Otrs
Otrs
6.5
1%
Jun 14DoS attack can be performed when an email contains specially designed URL in the body
CVE-2021-21438
FA
Faq
Otrs
4.3
1%
Mar 22Agents are able to see linked FAQ articles without permissions (defined in FAQ Category)
CVE-2021-21437
IT
Itsmconfigurationmanagement
Otrs
4.3
1%
Mar 22Agents are able to see linked Config Items without permissions, which are defined in General Catalog
CVE-2021-21436
CI
Cis IN Customer Frontend
Otrs
4.3
1%
Feb 8Agents are able to see and link Config Items without permissions, which are defined in General Catalog
CVE-2021-21435
OT
Otrs
Otrs
6.5
1%
Feb 8Article Bcc fields and agent personal information are shown when customer prints the ticket (PDF) via external interface
CVE-2021-21434
SU
Survey
Otrs
4.8
1%
Feb 8Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e
CVE-2020-1779
TF
Ticket Forms
Otrs
4.9
1%
Feb 8When dynamic templates are used (OTRSTicketForms), admin can use OTRS tags which are not masked properly and can reveal sensitive information