CVE-2026-36214

6.4 Moyenne

Publiée le 14/07/2026 à 19:16 · Modifiée le 04/08/2026 à 20:16 · Analyse NVD reportée · Source : cve@mitre.org

Description

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.

Traduire en français

Produits concernés

osTicket

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.4 Moyenne	cve@mitre.org	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`
3.1	5.4 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://enhancesoft.com/
https://github.com/WesWrench/CVE-2026-36214
https://github.com/osTicket/osTicket/commit/5afdf5450ff5c7d218447014b7abbb5f1e6dd42f
https://github.com/osTicket/osTicket/releases/tag/v1.17.8
https://github.com/osTicket/osTicket/releases/tag/v1.18.4
https://osticket.com/
https://github.com/WesWrench/CVE-2026-36214

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories