CVE-2020-12629

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/osTicket/osTicket/compare/v1.14.1...v1.14.2Patch, Third Party Advisory
https://github.com/osticket/osticket/commit/fc4c8608fa122f38673b9dddcb8fef4a15a9c884Patch, Third Party Advisory
https://www.exploit-db.com/exploits/48413Exploit, Third Party Advisory, VDB Entry
https://github.com/osTicket/osTicket/compare/v1.14.1...v1.14.2Patch, Third Party Advisory
https://github.com/osticket/osticket/commit/fc4c8608fa122f38673b9dddcb8fef4a15a9c884Patch, Third Party Advisory
https://www.exploit-db.com/exploits/48413Exploit, Third Party Advisory, VDB Entry

Timeline

Published: May 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-12635.5An information disclosure vulnerability exists in the way Windows Error Reporting (WER) handles objects in memory, aka 'Windows Error Report CVE-2020-126356.1XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.CVE-2020-126379.8Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to rec CVE-2020-126386.8An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTO CVE-2020-126396.1phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.CVE-2020-12647.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva CVE-2020-126409.8Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_pl CVE-2020-126419.8rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set CVE-2020-126427.5An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosur CVE-2020-126434.3OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.CVE-2020-126445.0OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.CVE-2020-126459.8OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and