CVE-2010-0606

no score yetEPSS 0.9%

Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2010-02-11
Modified: 2026-07-10
Record from: the NVD, synced 2026-10-19

Affected

enhancesoft:osticket
osticket:osticket

References

http://osticket.com/forums/project.php?issueid=176
http://packetstormsecurity.org/1002-exploits/osTicket-1.6-RC5-ReflectedXSS.pdf
http://secunia.com/advisories/38515
http://www.securityfocus.com/bid/38166
http://osticket.com/forums/project.php?issueid=176

Check your stack JSON