Enhancesoft vulnerabilities
We track 4 vulnerabilities in Enhancesoft products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 30, 2026.
Latest Enhancesoft vulnerabilities
- 9.1 Critical severity
osTicket: Weak Password Recovery Mechanism for Forgotten Password
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whet
- 7.5 High severity
osTicket: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filte
- 7.5 High severity
Osticket: Improper Validation of Specified Quantity in Input
A denial of service attack might be launched against the server if an unusually lengthy password (more than 10000000 characters) is supplied using the osTicket application. This can cause the website to go down or stop responding. When a long password is enter
- 9.8 Critical severity
Audit Log: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function.