CyberRota Analysis
AI-GeneratedA stored cross-site scripting (XSS) vulnerability in osTicket 1.18.3 allows attackers to inject arbitrary JavaScript through the thread entry title field, which is improperly sanitized. This flaw can lead to unauthorized actions or data exposure when the malicious input is rendered in staff-facing templates. Organizations using this version of osTicket should prioritize patching to mitigate potential security risks associated with user-controlled input.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.