Description
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2013-5789 Vulnerability (CVE-2013-5789)
MySQL CVE-2023-22015 Vulnerability (CVE-2023-22015)
Atlassian Confluence CVE-2020-29448 Vulnerability (CVE-2020-29448)
WordPress Plugin 3D Banner Rotator 'upload.php' Arbitrary File Upload (2.1)
WordPress Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4422)