CVE-2015-1347

Medium

Published: 23/01/2015(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.35%

68th percentile - higher than 68% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

Risk Assessment

The risk for the organization includes potential session hijacking, redirection to malicious sites, or unauthorized actions performed in the victim's browser context.

Recommendation

It is recommended to immediately upgrade osTicket to version 1.9.5.1 or later, which includes a fix for the XSS vulnerability.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.