CVE-2021-45811

6.5 mediumEPSS 2.5%

Medium (6.5) in enhancesoft osticket. EPSS 2.5% chance of exploitation in the next 30 days.

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2023-09-08
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

enhancesoft:osticket

References

https://members.backbox.org/osticket-sql-injection/
https://members.backbox.org/osticket-sql-injection/

Check your stack JSON