CVE-2018-7193

MediumCVSS 6.1

Published: 27/03/2018(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.48%

83th percentile - higher than 83% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions within the victim's browser context.

Recommendation

Immediately upgrade osTicket to version 1.10.2 or later, which includes a fix for this XSS vulnerability.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.