CVE-2021-42235: Enhancesoft Osticket

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality.

Affected products

• Enhancesoft Osticket: before 1.14.8 (fixed in 1.14.8); from 1.15, before 1.15.4 (fixed in 1.15.4)

Published 2022-05-04. Last modified 2026-06-17.