CVE-2020-10098: Zammad

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious JavaScript will execute within the browser of any user who opens the Ticket with the Article created from that Email.

Affected products

• Zammad Zammad: from 1.0.0, up to and including 3.2.0

Published 2020-03-05. Last modified 2026-06-17.