CVE-2010-0606: Enhancesoft Osticket

Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.

Affected products

• Enhancesoft Osticket: up to and including 1.6; version 1.2.7 only; version 1.3.0 only; version 1.6 only
• Osticket Osticket: version 1 only

Published 2010-02-11. Last modified 2026-07-10.