CVE-2018-7192

MediumCVSS 6.1

Published: 27/03/2018(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.07%

79th percentile - higher than 79% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions in the victim's browser context, compromising data confidentiality and integrity.

Recommendation

Immediately upgrade osTicket to version 1.10.2 or later, which includes a fix for this XSS vulnerability.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter.