OA
Vendor
OTRS AG
45
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-48187 | OT OTRS OTRS AG | 5.7 | Jun 1 | Email with special content can lead to DoS |
| CVE-2026-48188 | OC ((OTRS)) Community Edition OTRS AG | 9.1 | Jun 1 | SQL Injection via MySQL Quote Method |
| CVE-2026-48189 | OT OTRS OTRS AG | 5.7 | Jun 1 | Bypass DedicatedAgentToCustomerGroups Setting |
| CVE-2026-48190 | OT OTRS OTRS AG | 3.5 | Jun 1 | Incorrect handling of permissions in External Interface Config Item List module |
| CVE-2026-48191 | OT OTRS OTRS AG | 3.5 | Jun 1 | Wrong Permission Handling in Document Search Article Meta Filters |
| CVE-2026-48208 | OT OTRS OTRS AG | 6.5 | Jun 1 | Denial-of-Service via SVG Rendering in Ticket |
| CVE-2026-48209 | OT OTRS OTRS AG | 7.1 | Jun 1 | Reflected XSS in authenticated agent context |
| CVE-2026-48210 | OT OTRS OTRS AG | 5.7 | May 31 | Possible information disclosure via External Interface |
| CVE-2026-6060 | OT OTRS OTRS AG | 4.5 | Apr 20 | Possible DoS via SQL Box |
| CVE-2025-24391 | OT OTRS OTRS AG | 5.3 | Jul 14 | Possible user enumeration |
| CVE-2025-24388 | OC ((OTRS)) Community Edition OTRS AG | 3.8 | Jun 16 | Unsafe handling of AJAX calls |
| CVE-2025-24387 | OT OTRS OTRS AG | 6.5 | Mar 10 | Missing CSRF protection |
| CVE-2025-24390 | OT OTRS OTRS AG | 6.8 | Jan 27 | Missing Cookie Flags |
| CVE-2025-24389 | OC ((OTRS)) Community Edition OTRS AG | 6.3 | Jan 27 | SMTP Password will be shown in cleartext on some SMTP errors |
| CVE-2024-43446 | OT OTRS OTRS AG | 3.5 | Jan 27 | Improper check of permissions in Generic Interface |
| CVE-2024-43445 | OT OTRS OTRS AG | 5.4 | Jan 27 | Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing |
| CVE-2024-43444 | OT OTRS OTRS AG | 8.2 | Aug 26 | Passwords are written to Admin Log Module |
| CVE-2024-43443 | OC ((OTRS)) Community Edition OTRS AG | 4.9 | Aug 26 | Stored XSS in process management |
| CVE-2024-43442 | OT OTRS OTRS AG | 4.9 | Aug 26 | Stored XSS in System Configuration |
| CVE-2024-23794 | OT OTRS OTRS AG | 7.5 | Jul 15 | Agents are able to lock the ticket without the "Owner" permission |
| CVE-2024-6540 | OT OTRS OTRS AG | 5.3 | Jul 15 | Information exlosure in external interface |
| CVE-2024-23793 | OC ((OTRS)) Community Edition OTRS AG | 6.3 | Jun 6 | Upload of files outside application directory |
| CVE-2024-23790 | OT OTRS OTRS AG | 9.8 | Jan 29 | Missing file type check in avatar picture upload |
| CVE-2024-23791 | OT OTRS OTRS AG | 7.5 | Jan 29 | Unnecessary data is written to log if issues during indexing occurs |
| CVE-2024-23792 | OT OTRS OTRS AG | 6.5 | Jan 29 | Insufficient access control |
| CVE-2023-6254 | OT OTRS OTRS AG | 7.5 | Nov 27 | Password is send back to client |
| CVE-2023-5421 | OT OTRS OTRS AG | 5.5 | Oct 16 | Possible XSS execution in customer information |
| CVE-2023-38059 | OT OTRS OTRS AG | 5.3 | Oct 16 | External pictures can be loaded even if not allowed by configuration |
| CVE-2023-5422 | OC ((OTRS)) Community Edition OTRS AG | 9.1 | Oct 16 | SSL Certificates are not checked for E-Mail Handling |
| CVE-2022-39052 | OC ((OTRS)) Community Edition OTRS AG | 6.5 | Oct 17 | DoS attack using email |