OpenSupports vulnerabilities
We track 2 vulnerabilities in OpenSupports products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 3, 2025.
2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score
Latest OpenSupports vulnerabilities
- 7.1 High severity
OpenSupports: Improper Neutralization of Special Elements used in an SQL Command
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, ef
- 9.8 Critical severity
opensupports: Unrestricted Upload of File with Dangerous Type
OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This ca