Advisories · Technology

OTRS AG ((OTRS)) Community Edition.

Every CVE that names OTRS AG ((OTRS)) Community Edition among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-48187 CVE record

CVSS 5.7 Medium

Email with special content can lead to DoS
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Denial of service
Not analysed yet 1 Jun 2026
CVE-2026-48188 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SQL Injection via MySQL Quote Method
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 1 Jun 2026
CVE-2026-48208 CVE record

CVSS 6.5 Medium

Denial-of-Service via SVG Rendering in Ticket
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Denial of service
- CWE-791
Not analysed yet 1 Jun 2026
CVE-2026-48209 CVE record

CVSS 7.1 High

Reflected XSS in authenticated agent context
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
- CWE-116
Not analysed yet 1 Jun 2026
CVE-2025-24388 CVE record

CVSS 3.8 Low

Unsafe handling of AJAX calls
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-184
Not analysed yet 16 Jun 2025
CVE-2025-24389 CVE record

CVSS 6.3 Medium

SMTP Password will be shown in cleartext on some SMTP errors
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Information disclosure
Not analysed yet 27 Jan 2025
CVE-2024-43446 CVE record

CVSS 3.5 Low

Improper check of permissions in Generic Interface
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Privilege escalation
Not analysed yet 27 Jan 2025
CVE-2024-43445 CVE record

CVSS 5.4 Medium

Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 27 Jan 2025
CVE-2024-43444 CVE record

CVSS 8.2 High

Passwords are written to Admin Log Module
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Information disclosure
Not analysed yet 26 Aug 2024
CVE-2024-43443 CVE record

CVSS 4.9 Medium

Stored XSS in process management
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-790
Not analysed yet 26 Aug 2024
CVE-2024-43442 CVE record

CVSS 4.9 Medium

Stored XSS in System Configuration
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
- CWE-790
Not analysed yet 26 Aug 2024
CVE-2024-23793 CVE record

CVSS 6.3 Medium

Upload of files outside application directory
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Path traversal
Not analysed yet 6 Jun 2024
CVE-2023-5421 CVE record

CVSS 3.5 Low

Possible XSS execution in customer information
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 16 Oct 2023
CVE-2023-38059 CVE record

CVSS 5.3 Medium

External pictures can be loaded even if not allowed by configuration
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Information disclosure
Not analysed yet 16 Oct 2023
CVE-2023-5422 CVE record

CVSS 8.7 High

SSL Certificates are not checked for E-Mail Handling
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Weak cryptography or TLS
Not analysed yet 16 Oct 2023
CVE-2023-38060 CVE record

CVSS 6.3 Medium

Host header injection by attachments in web service
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 24 Jul 2023
CVE-2023-38057 CVE record

CVSS 4.1 Medium

XSS stored in survey answers
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 24 Jul 2023
CVE-2023-38056 CVE record

CVSS 7.2 High

Code execution via System Configuration
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Command injection
Not analysed yet 24 Jul 2023
CVE-2023-1250 CVE record

CVSS 7.4 High

Code execution through ACL creation
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 20 Mar 2023
CVE-2023-1248 CVE record

CVSS 6.1 Medium

Possible XSS in Ticket Actions
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
Not analysed yet 20 Mar 2023
CVE-2022-4427 CVE record

CVSS 6.5 Medium

SQL Injection via OTRS Search API
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-20
Not analysed yet 19 Dec 2022
CVE-2022-39052 CVE record

CVSS 7.5 High

DoS attack using email
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Denial of service
Not analysed yet 17 Oct 2022
CVE-2022-39051 CVE record

CVSS 6.8 Medium

Perl Code execution in Template Toolkit
- OTRS
- OTRS AG ((OTRS)) Community Edition
- CWE-913
Not analysed yet 5 Sept 2022
CVE-2022-39050 CVE record

CVSS 4.6 Medium

Possible XSS stored in customer information
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
Not analysed yet 5 Sept 2022
CVE-2022-39049 CVE record

CVSS 3.5 Low

Possible XSS in Admin Interface
- OTRS
- OTRS AG ((OTRS)) Community Edition
- Cross-site scripting (XSS)
Not analysed yet 5 Sept 2022
CVE-2021-36100 CVE record

CVSS 6.4 Medium

Authenticated remote code execution
- OTRS
- OTRS AG SystemMonitoring
Not analysed yet 21 Mar 2022
CVE-2021-36096 CVE record

CVSS 5.2 Medium

Support Bundle includes S/Mime and PGP secret or PIN
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 6 Sept 2021
CVE-2021-36095 CVE record

CVSS 5.3 Medium

User enumeration issue using "lost password" feature
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 6 Sept 2021
CVE-2021-36094 CVE record

CVSS 5.7 Medium

XSS attack in appointment edit popup screen
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
Not analysed yet 6 Sept 2021
CVE-2021-36093 CVE record

CVSS 5.3 Medium

DoS attack using PostMaster filters
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-185
Not analysed yet 6 Sept 2021
CVE-2021-36092 CVE record

CVSS 6.5 Medium

XSS attack using special link in email
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
Not analysed yet 26 Jul 2021
CVE-2021-36091 CVE record

CVSS 3.5 Low

Unautorized access to the calendar appointments
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 26 Jul 2021
CVE-2021-21443 CVE record

CVSS 3.5 Low

Unautorized listing of the customer user emails
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 26 Jul 2021
CVE-2021-21440 CVE record

CVSS 5.2 Medium

Support Bundle includes S/Mime and PGP keys
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 26 Jul 2021
CVE-2021-21441 CVE record

CVSS 7.5 High

XSS in the ticket overview screens
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
Not analysed yet 16 Jun 2021
CVE-2021-21439 CVE record

CVSS 6.5 Medium

Possible DoS attack using a special crafted URL in email body
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-754
Not analysed yet 14 Jun 2021
CVE-2020-1776 CVE record

CVSS 3.5 Low

Invalidating or changing user does not invalidate session
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Authentication bypass
Not analysed yet 20 Jul 2020
CVE-2020-1774 CVE record

CVSS 4.5 Medium

Information disclosure
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 28 Apr 2020
CVE-2020-1773 CVE record

CVSS 7.3 High

Session / Password / Password token leak
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-331
Not analysed yet 27 Mar 2020
CVE-2020-1772 CVE record

CVSS 6.5 Medium

Information Disclosure
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-155
Not analysed yet 27 Mar 2020
CVE-2020-1771 CVE record

CVSS 4.6 Medium

Possible XSS in Customer user address book
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
Not analysed yet 27 Mar 2020
CVE-2020-1770 CVE record

CVSS 2.4 Low

Information disclosure in support bundle files
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Information disclosure
Not analysed yet 27 Mar 2020
CVE-2020-1769 CVE record

CVSS 3.5 Low

Autocomplete in the form login screens
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-16
Not analysed yet 27 Mar 2020
CVE-2020-1767 CVE record

CVSS 3.5 Low

Possible to send drafted messages as wrong agent
- OTRS AG ((OTRS)) Community Edition
- OTRS
Not analysed yet 10 Jan 2020
CVE-2020-1766 CVE record

CVSS 2.0 Low

Improper handling of uploaded inline images
- OTRS AG ((OTRS)) Community Edition
- OTRS
- Cross-site scripting (XSS)
Not analysed yet 10 Jan 2020
CVE-2020-1765 CVE record

CVSS 3.5 Low

Spoofing of From field in several screens
- OTRS AG ((OTRS)) Community Edition
- OTRS
- CWE-472
Not analysed yet 10 Jan 2020