Description

SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.

Remediation

References

CVE-2021-42235

Related Vulnerabilities

MySQL CVE-2014-2430 Vulnerability (CVE-2014-2430)

Tornado Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-52804)

WordPress Plugin Wallable-Social Networking Arbitrary File Upload (1.1)

WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-60200)

WordPress Plugin PHP Event Calendar for WordPress Arbitrary File Upload (1.6)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2021-42235