OT
Product
OTRS
44
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 10Medium 26Low 4
Watch
Add OTRS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24390 | 6.8 | Jan 27 | Missing Cookie Flags Affected: 7.0.x; 8.0.x; 2023.x; 2024.x |
| CVE-2026-48208 | 6.5 | Jun 1 | Denial-of-Service via SVG Rendering in Ticket Affected: 7.0.x; 8.0.x; 2023.x; 2024.x; 2025.x; 2026.x through 2026.3.x |
| CVE-2025-24387 | 6.5 | Mar 10 | Missing CSRF protection Affected: 7.0.x; 8.0.x; 2023.x; 2024.x; 2025.x through 2025.1.2 |
| CVE-2024-23792 | 6.5 | Jan 29 | Insufficient access control Affected: 7.0.x through 7.0.48; 8.0.x through 8.0.37; 2023.x through 2023.1.1 |
| CVE-2022-39052 | 6.5 | Oct 17 | DoS attack using email Affected: 7.0.x through 7.0.39; 8.0.x through 8.0.26 |
| CVE-2025-24389 | 6.3 | Jan 27 | SMTP Password will be shown in cleartext on some SMTP errors Affected: 7.0.x; 8.0.x; 2023.x; 2024.x |
| CVE-2024-23793 | 6.3 | Jun 6 | Upload of files outside application directory Affected: 7.0.x through 7.0.49; 8.0.x; 2023.x; 2024.x through 2024.3.2 |
| CVE-2023-1248 | 6.1 | Mar 20 | Possible XSS in Ticket Actions Affected: 7.0.x before 7.0.42 |
| CVE-2026-48187 | 5.7 | Jun 1 | Email with special content can lead to DoS Affected: 8.0.x; 2023.x; 2024.x; 2025.x; 2026.x through 2026.3.x |
| CVE-2026-48189 | 5.7 | Jun 1 | Bypass DedicatedAgentToCustomerGroups Setting Affected: 7.0.x; 8.0.x; 2023.x; 2024.x; 2025.x; 2026.x through 2026.3.x |
| CVE-2026-48210 | 5.7 | May 31 | Possible information disclosure via External Interface Affected: 2026.3.1 |
| CVE-2023-5421 | 5.5 | Oct 16 | Possible XSS execution in customer information Affected: 7.0.x before 7.0.47; 8.0.x before 8.0.37 |
| CVE-2024-43445 | 5.4 | Jan 27 | Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing Affected: 7.0.x; 8.0.x; 2023.x; 2024.x; 2025.x before 2025.1.x |
| CVE-2023-38057 | 5.4 | Jul 24 | XSS stored in survey answers Affected: 7.0.x before 7.0.32; 8.0.x before 8.0.13 |
| CVE-2025-24391 | 5.3 | Jul 14 | Possible user enumeration Affected: 7.0.x; 8.0.x; 2023.x; 2024.x; 2025.x through 2025.5.x |
| CVE-2024-6540 | 5.3 | Jul 15 | Information exlosure in external interface Affected: 8.0.x; 2023.x; 2024.x through 2024.4.x |
| CVE-2023-38059 | 5.3 | Oct 16 | External pictures can be loaded even if not allowed by configuration Affected: 7.0.x before 7.0.47; 8.0.x before 8.0.37 |
| CVE-2022-32741 | 5.3 | Jun 13 | Information disclosure in Request New Password feature Affected: 7.0.x through 7.0.34; 8.0.x through 8.0.22 |
| CVE-2022-32740 | 5.3 | Jun 13 | Information disclosure in the External Interface Affected: 7.0.x through 7.0.34; 8.0.x through 8.0.22 |
| CVE-2022-32739 | 5.3 | Jun 13 | OTRS version number is always in the exported ICS files Affected: 7.0.x through 7.0.34; 8.0.x through 8.0.22 |
| CVE-2024-43443 | 4.9 | Aug 26 | Stored XSS in process management Affected: 7.0.x through 7.0.50; 8.0.x; 2023.x; 2024.x through 2024.5.x |
| CVE-2024-43442 | 4.9 | Aug 26 | Stored XSS in System Configuration Affected: 7.0.x through 7.0.50; 8.0.x; 2023.x; 2024.x through 2024.5.x |
| CVE-2022-39050 | 4.8 | Sep 5 | Possible XSS stored in customer information Affected: 7.0.x through 7.0.36; 8.0.x through 8.0.24 |
| CVE-2022-39049 | 4.8 | Sep 5 | Possible XSS in Admin Interface Affected: 7.0.x through 7.0.36; 8.0.x through 8.0.24 |
| CVE-2026-6060 | 4.5 | Apr 20 | Possible DoS via SQL Box Affected: 7.0.x; 8.0.x; 2023.x; 2024.x; 2025.x; 2026.x through 2026.2.x |
| CVE-2023-38058 | 4.3 | Jul 24 | Tickets can be moved without permissions Affected: 8.0.x before 8.0.35 |
Showing 26