Bestpractical / Request Tracker
35 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-44230 | RT: Reflected Cross-Site Scripting in search results chart | MEDIUM | 6.1 | Jul 20, 2026 |
| CVE-2026-44231 | RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint | CRITICAL | 9.1 | Jul 20, 2026 |
| CVE-2026-44229 | RT: Cross-Site Scripting via inline-served uploaded content | MEDIUM | 5.4 | Jul 20, 2026 |
| CVE-2026-44228 | RT: Stored Cross-Site Scripting via insufficient template escaping | MEDIUM | 5.4 | Jul 20, 2026 |
| CVE-2026-44227 | RT: Reflected Cross-Site Scripting via URL parameters | MEDIUM | 6.1 | Jul 20, 2026 |
| CVE-2026-6841 | Reflected XSS in Request Tracker | MEDIUM | 5.1 | May 21, 2026 |
| CVE-2025-61873 | Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. | LOW | 2.6 | Jan 16, 2026 |
| CVE-2025-9158 | Stored XSS in Request Tracker | MEDIUM | 5.3 | Oct 24, 2025 |
| CVE-2025-31501 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink. | HIGH | 7.2 | May 28, 2025 |
| CVE-2025-31500 | Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name. | HIGH | 7.2 | May 28, 2025 |
| CVE-2025-30087 | Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL. | HIGH | 7.2 | May 28, 2025 |
| CVE-2025-2545 | Deprecated 3DES cryptographic algorithm used by Request Tracker in emails encrypted with S/MIME | LOW | 2.3 | May 5, 2025 |
| CVE-2024-3262 | Information exposure vulnerability in Request Tracker (RT) | MEDIUM | 5.5 | Apr 4, 2024 |
| CVE-2023-45024 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. | HIGH | 7.5 | Nov 3, 2023 |
| CVE-2023-41260 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. | HIGH | 7.5 | Nov 3, 2023 |
| CVE-2023-41259 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or… | HIGH | 7.5 | Nov 3, 2023 |
| CVE-2022-25803 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. | MEDIUM | 6.1 | Jul 14, 2022 |
| CVE-2022-25802 | Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment. | MEDIUM | 6.1 | Jul 14, 2022 |
| CVE-2021-38562 | Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack again… | HIGH | 7.5 | Oct 18, 2021 |
| CVE-2018-18898 | The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity att… | HIGH | 7.5 | Mar 17, 2019 |
| CVE-2017-5944 | The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated us… | HIGH | 8.8 | Jul 3, 2017 |
| CVE-2017-5943 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site re… | HIGH | 8.8 | Jul 3, 2017 |
| CVE-2017-5361 | Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes… | MEDIUM | 5.9 | Jul 3, 2017 |
| CVE-2016-6127 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachm… | MEDIUM | 6.1 | Jul 3, 2017 |
| CVE-2015-6506 | Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web sc… | MEDIUM | 4.3 | Sep 3, 2015 |
Showing 1 to 25 of 35 CVEs