CVE-2020-16193

MediumCVSS 5.4/10Last modified Jul 10, 2026

Description

osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/osTicket/osTicket/blob/develop/include/staff/banrule.inc.php#L67Patch, Third Party Advisory
https://github.com/osTicket/osTicket/pull/5616/commits/fb570820ef1138776f929a179906e1d8089179d9Patch, Third Party Advisory
https://github.com/osTicket/osTicket/blob/develop/include/staff/banrule.inc.php#L67Patch, Third Party Advisory
https://github.com/osTicket/osTicket/pull/5616/commits/fb570820ef1138776f929a179906e1d8089179d9Patch, Third Party Advisory

Timeline

Published: Aug 26, 2020
Last modified: Jul 10, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-161945.3An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2. Unauthenticated attackers can have acc CVE-2020-161974.3An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scop CVE-2020-161986.3When an attacker claims to have a given identity, Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not prove or i CVE-2020-161997.8Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple stack-based buffer overflow vulnerabilities may be ex CVE-2020-16205.5A local, authenticated user with shell can obtain the hashed values of login passwords via configd streamer log. This issue affects all vers CVE-2020-162006.5Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not properly control the allocation and maintenance of a limited CVE-2020-162013.3Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited b CVE-2020-162027.8WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code exe CVE-2020-162037.8Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a spec CVE-2020-162049.8The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as CVE-2020-162057.2Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1 CVE-2020-162069.0The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbitrary code to gain ac