CVE-2005-1436
MediumExploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via the t, osticket_title, em, e, err parameters and the name and subject fields when adding a ticket.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions in the victim's browser context.
Recommendation
Immediately update osTicket to the latest version and apply input filtering and encoding to all mentioned parameters and fields.
Original NVD description (English source)
Multiple cross-site scripting (XSS) vulnerabilities in osTicket allow remote attackers to inject arbitrary web script or HTML via (1) the t parameter to view.php, (2) the osticket_title parameter to header.php, (3) the em parameter to admin_login.php, (4) the e parameter to user_login.php, (5) the err parameter to open_submit.php, or (6) the name and subject fields when adding a ticket.