CVE-2017-15362

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.

• CWE-79

• https://becomepentester.blogspot.ae/2017/10/osTicket-XSS-CVE-2017-15362.htmlThird Party Advisory
• https://becomepentester.blogspot.ae/2017/10/osTicket-XSS-CVE-2017-15362.htmlThird Party Advisory

Published

Oct 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15357The setpermissions function in the auto-updater in Arq befor…
• CVE-2017-15358Race condition in the Charles Proxy Settings suid binary in …
• CVE-2017-15359In the 3CX Phone System 15.5.3554.1, the Management Console …
• CVE-2017-1536IBM Support Tools for Lotus WCM (IBM WebSphere Portal 7.0, 8…
• CVE-2017-15360PRTG Network Monitor version 17.3.33.2830 is vulnerable to s…
• CVE-2017-15361The Infineon RSA library 1.02.013 in Infineon Trusted Platfo…
• CVE-2017-15363Directory traversal vulnerability in public/examples/resourc…7.5
• CVE-2017-15364The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remo…
• CVE-2017-15365sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2…
• CVE-2017-15366Before Thornberry NDoc version 8.0, laptop clients and the s…
• CVE-2017-15367Bacula-web before 8.0.0-rc2 is affected by multiple SQL Inje…
• CVE-2017-15368The wasm_dis function in libr/asm/arch/wasm/wasm.c in radare…