CVE-2012-4751
OTRS Help Desk <2.4.15, <3.0.17, <3.1.11 - XSS
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Mike Eduard · pythonwebappswindows
https://www.exploit-db.com/exploits/22070
exploitdb
WORKING POC
by Mike Eduard · pythonwebappswindows
https://www.exploit-db.com/exploits/20959
References (7)
Scores
EPSS
0.0786
EPSS Percentile
91.9%
Details
CWE
CWE-79
Status
published
Products (50)
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
otrs/otrs
... and 40 more
Published
Oct 22, 2012
Tracked Since
Feb 18, 2026