CVE-2010-0606

Low

Published: 11/02/2010(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.87%

55th percentile - higher than 55% of all known CVEs

Summary

Cross-site scripting (XSS) vulnerability in scp/ajax.php of osTicket before version 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.

Risk Assessment

An attacker can steal session cookies of administrators or other authenticated users, leading to account takeover and unauthorized access to the ticketing system.

Recommendation

Immediately upgrade osTicket to version 1.6.0 Stable or later, which includes a fix for this XSS vulnerability.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users to inject arbitrary web script or HTML via the f parameter, possibly related to an error message generated by scp/admin.php.