CVE-2018-7196

MediumCVSS 6.1

Published: 27/03/2018(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.48%

83th percentile - higher than 83% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was found in osTicket before version 1.10.2 in the /scp/index.php script. An attacker can inject arbitrary JavaScript or HTML code via the "sort" parameter.

Risk Assessment

The risk involves the execution of malicious scripts in the administrator's browser, potentially leading to session theft, account takeover, or data theft.

Recommendation

Immediately upgrade osTicket to version 1.10.2 or later, which includes a fix for this XSS vulnerability.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter.