CVE-2026-38444

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. When an unauthenticated attacker sends a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.

• CWE-79

• https://github.com/fr3akhacks/cve-disclosures/blob/master/osTicket/CVE-2026-38444.md
• https://github.com/osTicket/osTicket/blob/develop/include/class.mailparse.php
• https://github.com/osTicket/osTicket/commit/c54a6ac79de42cff35b453882d1d94cd38adb17f

Published

Aug 3, 2026

Last Modified

Aug 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-38428Kestra v1.3.3 and before is vulnerable to SQL Injection. The…9.8
• CVE-2026-38429OpenCMS v20 and before is vulnerable to XML External Entity …9.8
• CVE-2026-3843Nefteprodukttekhnika BUK TS-G Gas Station Automation System …9.8
• CVE-2026-38431ERPNext v15.103.1 and before is vulnerable to Server-Side Te…9.8
• CVE-2026-38432ERPNext v15.103.1 and before is vulnerable to Cross Site Scr…6.1
• CVE-2026-3844The Breeze Cache plugin for WordPress is vulnerable to arbit…9.8
• CVE-2026-38446A stored cross-site scripting (XSS) vulnerability exists in …6.1
• CVE-2026-38447osTicket 1.18.3 generates API keys using a predictable const…9.8
• CVE-2026-3845Heap buffer overflow in the Audio/Video: Playback component …8.8
• CVE-2026-38450An issue in Aetopia Digital Asset Management DAM v.1.0.0 all…9.8
• CVE-2026-3846Same-origin policy bypass in the CSS Parsing and Computation…6.5
• CVE-2026-38465A Stored XSS vulnerability in the donor avatar mouse-over te…5.4