AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2019-14748

MEDIUM · CVSS 5.4 EPSS 2.73% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2019-08-07 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗
External Security References
packetstormsecurity.com ↗ exploit-db.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2019-14748
Severity
MEDIUM
CVSS
5.4
EPSS
2.73%

Original NVD Description

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.