CVE-2021-42235

9.8 criticalEPSS 1.0%

Critical (9.8) in enhancesoft osticket. EPSS 1.0% chance of exploitation in the next 30 days.

SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2022-05-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

enhancesoft:osticket

References

https://github.com/osTicket/osTicket/commit/e28291022e662ffa754e170c09cade7bdadf3fd9
https://github.com/osTicket/osTicket/commit/e28291022e662ffa754e170c09cade7bdadf3fd9

Check your stack JSON