CVE Feed

    Dashboard / CVE / CVE-2026-48212

    CVE-2026-48212

    An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

    Published:Oct 12, 2026
    Last Modified:Oct 15, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00142
    CVSS Score:4.8

    Affected Products

    Vendor
    Otrs
    Product
    Otrs

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-93582 (CVSS 9.4) — The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated usern…
    CVE-2026-93581 (CVSS 6.1) — User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from …
    CVE-2026-78359 (CVSS 5.4) — OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured Custo…
    CVE-2026-78358 (CVSS 4.3) — Several administrative actions do not sufficiently validate whether a request was intentionally initiated by t…
    CVE-2026-78357 (CVSS 9.1) — Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user ac…
    CVE-2026-78356 (CVSS 5.3) — The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthentic…
    CVE-2026-78355 (CVSS 8.7) — A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrat…
    CVE-2026-48211 (CVSS 5.4) — An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross…
    CVE-2026-48187 (CVSS 5.7) — An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows exc…
    CVE-2026-48188 (CVSS 9.1) — An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High