CVE-2015-1176

Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.

Affected products

Osticket

Enhancesoft Osticket

≤ 1.9.4

Fix

Available

CVSS 2.0

4.3 MEDIUM

EPSS

1.9% (78th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2015-01-23