CVE-2012-4751

OTRS Help Desk <2.4.15, <3.0.17, <3.1.11 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Mike Eduard · pythonwebappswindows
https://www.exploit-db.com/exploits/22070
exploitdb WORKING POC
by Mike Eduard · pythonwebappswindows
https://www.exploit-db.com/exploits/20959

Scores

EPSS 0.0786
EPSS Percentile 91.9%

Details

CWE
CWE-79
Status published
Products (50)
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
... and 40 more
Published Oct 22, 2012
Tracked Since Feb 18, 2026