CVE-2026-38446: A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stor
A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-38446
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-38446 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for A stored cross-site
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-38444: osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header …nvd · 2026-08-03
- mediumCVE-2026-67612: OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient port…nvd · 2026-08-03
- unknownCVE-2026-69075: FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-con…nvd · 2026-08-03
- mediumCVE-2026-68583: luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in t…nvd · 2026-08-02
- mediumCVE-2026-12231: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scr…nvd · 2026-08-02
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…nvd · 2026-08-01
More from NVD Recent CVEs
- highCVE-2026-59913: Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missin…2026-08-03
- highCVE-2026-59912: Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Impro…2026-08-03
- unknownCVE-2026-38447: osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The …2026-08-03
- unknownCVE-2026-38444: osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header …2026-08-03
- criticalCVE-2026-18616: A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the f…2026-08-03