CVE-2019-14750

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.

• CWE-79

• http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12Patch, Third Party Advisory
• https://github.com/osTicket/osTicket/releases/tag/v1.10.7Release Notes, Third Party Advisory
• https://github.com/osTicket/osTicket/releases/tag/v1.12.1Release Notes, Third Party Advisory
• https://www.exploit-db.com/exploits/47226Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12Patch, Third Party Advisory
• https://github.com/osTicket/osTicket/releases/tag/v1.10.7Release Notes, Third Party Advisory
• https://github.com/osTicket/osTicket/releases/tag/v1.12.1Release Notes, Third Party Advisory
• https://www.exploit-db.com/exploits/47226Third Party Advisory, VDB Entry

Published

Aug 7, 2019

Last Modified

Jul 10, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14745In radare2 before 3.7.0, a command injection vulnerability e…7.8
• CVE-2019-14746A issue was discovered in KuaiFanCMS 5.0. It allows eval inj…
• CVE-2019-14747DWSurvey through 2019-07-22 has stored XSS via the design/my…
• CVE-2019-14748An issue was discovered in osTicket before 1.10.7 and 1.12.x…5.4
• CVE-2019-14749An issue was discovered in osTicket before 1.10.7 and 1.12.x…8.8
• CVE-2019-1475Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14751NLTK Downloader before 3.4.5 is vulnerable to a directory tr…
• CVE-2019-14752SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS…6.1
• CVE-2019-14753SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 h…7.5
• CVE-2019-14754Open-School 3.0, and Community Edition 2.3, allows SQL Injec…
• CVE-2019-14755The profile photo upload feature in Leaf Admin 61.9.0212.10 …
• CVE-2019-14756An issue was discovered in KaiOS 1.0, 2.5, and 2.5.12.5. The…6.1