Read the docs
TI-2017-11275 Aliases CVE-2017-15362GHSA-q9v5-48c9-9r2g

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who…

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.

Why it matters now

EPSS 0.0121 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:osticket:osticket:1.10.1:*:*:*:*:*:*:*1.10.1Vulnerableosticket
  • cpe:2.3:a:osticket:osticket:1.10.1:*:*:*:*:*:*:* Versions 1.10.1 Vulnerable ·osticket

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-15362
  2. 2026-10-03 Alias added: GHSA-q9v5-48c9-9r2g

References

Advisory 1

  • TI-2025-28770 osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php. CVSS 3.1MEDIUM 5.4
  • TI-2017-11381 osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. CVSS 3.0CRITICAL 9.8
  • TI-2017-10503 In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of… CVSS 3.0CRITICAL 9.8
  • TI-2010-00577 SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote… CVSS 2.0HIGH 7.5
  • TI-2005-01360 PHP remote file inclusion vulnerability in main.php in osTicket allows remote attackers… CVSS 2.0HIGH 7.5
  • TI-2005-01359 Multiple SQL injection vulnerabilities in osTicket allow remote attackers to execute… CVSS 2.0HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences