CVE-2014-4744
MediumExploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the Phone Number field in open.php or the passwd1, passwd2 fields and do parameter in account.php.
Risk Assessment
The risk includes potential session hijacking, redirection to malicious sites, or unauthorized actions performed in the victim's browser context.
Recommendation
Immediately upgrade osTicket to version 1.9.2 or later and implement input filtering and validation in forms.
Original NVD description (English source)
Multiple cross-site scripting (XSS) vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Phone Number field to open.php or (2) Phone number field, (3) passwd1 field, (4) passwd2 field, or (5) do parameter to account.php.