{"id":"CVE-2018-7196","title":"Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the \"sort\" parameter.","summary":"Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the \"sort\" parameter.","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"enhancesoft","product":"osticket","affected":["osticket <= 1.10.1"],"published":"2018-03-27","updated":"2026-07-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-7196","references":[{"url":"https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c","label":"cve@mitre.org"},{"url":"https://blog.securityevaluators.com/vulnerabilities-found-in-popular-ticketing-system-dd273bda229c","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.03092,"epssPercentile":0.87109,"ingestedAt":"2026-07-10T19:05:51.185Z","exploits":{"nuclei":["CVE-2018-7196"],"checkedAt":"2026-09-21T15:23:39.040Z"},"exploitAvailable":true,"slug":"CVE-2018-7196","body":"## Overview\n\nCross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the \"sort\" parameter.\n\n## Affected\n\n- `osticket <= 1.10.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0.6,"exploitation":12,"ransomware":0},"changes":[{"seq":4450,"id":"CVE-2018-7196","ts":1788887180721,"field":"exploit_available","old":"false","new":"true"},{"seq":3333,"id":"CVE-2018-7196","ts":1788886299702,"field":"exploit_available","old":"true","new":"false"},{"seq":2188,"id":"CVE-2018-7196","ts":1788882969415,"field":"exploit_available","old":"false","new":"true"},{"seq":1217,"id":"CVE-2018-7196","ts":1788882374193,"field":"exploit_available","old":"true","new":"false"},{"seq":331,"id":"CVE-2018-7196","ts":1788881815723,"field":"exploit_available","old":"false","new":"true"}]}