CVE-2010-0605High· 7.5▾ MidnightPoC available

SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter.

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 41.3 · likelihood 0.6 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Feb 11, 2010

Updated

Jul 10, 2026

CVSS

7.5

Vendor

enhancesoft

Product

osticket

CWE

CWE-89

Depth score

54 · Moderate

EPSS

3.0% · p87

Platforms

—

Source

NVD

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-21

Exploit-DB: Search Exploit-DB for CVE-2010-0605 ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 10.

3.0% → 3.0%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 6067 days

Feb 11, 2010Published
Disclosed via NVD
Jul 10, 2026Record revised
Last analysed / modified upstream
Jul 10, 2026EPSS first tracked
3.0%
Sep 21, 2026Public exploit observed
Exploit-DB (last check)

enhancesoft CWE-89 #nvd #exploit-available

Affected

osticket <= 1.6
osticket = 1.2.7
osticket = 1.3.0
osticket = 1.6
osticket = 1

Full technical detail▾

Overview

SQL injection vulnerability in scp/ajax.php in osTicket before 1.6.0 Stable allows remote authenticated users, with "Staff" permissions, to execute arbitrary SQL commands via the input parameter.

Affected

osticket <= 1.6
osticket = 1.2.7
osticket = 1.3.0
osticket = 1.6
osticket = 1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available