Otrs AG vulnerabilities
81 CVEs and advisories name Otrs AG as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-48187Email with special content can lead to DoS
- CVE-2026-48188SQL Injection via MySQL Quote Method
- CVE-2026-48189Bypass DedicatedAgentToCustomerGroups Setting
- CVE-2026-48190Incorrect handling of permissions in External Interface Config Item List module
- CVE-2026-48191Wrong Permission Handling in Document Search Article Meta Filters
- CVE-2026-48208Denial-of-Service via SVG Rendering in Ticket
- CVE-2026-48209Reflected XSS in authenticated agent context
- CVE-2026-48210Possible information disclosure via External Interface
- CVE-2026-6060Possible DoS via SQL Box
- CVE-2025-24391Possible user enumeration
- CVE-2025-24388Unsafe handling of AJAX calls
- CVE-2025-24387Missing CSRF protection
- CVE-2025-24390Missing Cookie Flags
- CVE-2025-24389SMTP Password will be shown in cleartext on some SMTP errors
- CVE-2024-43446Improper check of permissions in Generic Interface
- CVE-2024-43445Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing
- CVE-2024-43444Passwords are written to Admin Log Module
- CVE-2024-43443Stored XSS in process management
- CVE-2024-43442Stored XSS in System Configuration
- CVE-2024-23794Agents are able to lock the ticket without the "Owner" permission
- CVE-2024-6540Information exlosure in external interface
- CVE-2024-23793Upload of files outside application directory
- CVE-2024-23790Missing file type check in avatar picture upload
- CVE-2024-23791Unnecessary data is written to log if issues during indexing occurs
- CVE-2024-23792Insufficient access control
- CVE-2023-6254Password is send back to client
- CVE-2023-5421 Possible XSS execution in customer information
- CVE-2023-38059External pictures can be loaded even if not allowed by configuration
- CVE-2023-5422SSL Certificates are not checked for E-Mail Handling
- CVE-2023-38060Host header injection by attachments in web service