Medium severity6.1OSV Advisory· Published Apr 25, 2019· Updated Jul 10, 2026

CVE-2019-11537

Description

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Osticket/OsticketOSV3 versions
v1.10, v1.10-rc.3, v1.10.1, …+ 2 more
- (no CPE)range: v1.10, v1.10-rc.3, v1.10.1, …
- cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*range: <1.12
- (no CPE)range: <1.12

Patches

Vulnerability mechanics

References

pentest.com.tr/exploits/osTicket-v1-11-XSS-to-LFI.htmlnvdExploitThird Party Advisory
www.exploit-db.com/exploits/46753nvdExploitThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/46753/nvdExploitThird Party AdvisoryVDB Entry
github.com/osTicket/osTicket/pull/4869nvdThird Party Advisory
github.com/osTicket/osTicket/releases/tag/v1.12nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.004
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000