CVE-2015-1176

Medium

Published: 23/01/2015(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.89%

77th percentile - higher than 77% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5. Remote attackers can inject arbitrary web script or HTML via the status parameter in a search action.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions within the victim's browser context.

Recommendation

Immediately update osTicket to version 1.9.5 or later, which includes a fix for the XSS vulnerability.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.