CVE-2017-15362 — osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS

Back Back to CVE browser

MEDIUM

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS

Published Oct 16, 2017

6.1

MEDIUM

CVSS 3.0

EPSS 1.21%

Description

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.

Affected products

Remediation

No remediation recorded yet.

Metrics

1.21% 0.01210

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01210

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.21% (0.01210)	67.34th	v5 (v2026.06.15)
Sep 20, 2026	1.21% (0.01210)	67.09th	v5 (v2026.06.15)
Jul 20, 2024	0.08% (0.00084)	36.24th	v3 (v2023.03.01)
May 19, 2024	0.08% (0.00084)	35.46th	v3 (v2023.03.01)
Mar 7, 2023	0.08% (0.00077)	31.06th	v3 (v2023.03.01)
Mar 6, 2023	1.60% (0.01599)	75.52th	v2 (v2022.01.01)
Feb 4, 2022	1.09% (0.01086)	28.42th	v2 (v2022.01.01)
Feb 3, 2022	0.73% (0.00731)	20.40th	v5 (v2026.06.15)
Apr 14, 2021	0.73% (0.00731)	0.00th	v1