> CVE-2026-36214

« BACK_TO_HOME
PUBLISHED
2026-07-14 17:16
MODIFIED
2026-07-14 17:16
EPSS (Prob. Exploit)
0.38%
Top 69.3%
DATA SOURCES:
NVD 🔗 2026-07-14 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-07-19

> DESCRIPTION

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
63 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
14/07/2026 17:16
Source: NVD
Total des modifications: 0 Dernière mise à jour: 3 months ago

> REFERENCES

https://enhancesoft.com/
https://github.com/WesWrench/CVE-2026-36214
https://github.com/osTicket/osTicket/commit/5afdf5450ff5c7d218447014b7abbb5f1e6d...
https://github.com/osTicket/osTicket/releases/tag/v1.17.8
https://github.com/osTicket/osTicket/releases/tag/v1.18.4
https://osticket.com/
« BACK_TO_HOME