---
id: CVE-2019-14750
title: An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1
summary: >-
  An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
  Stored XSS exists in setup/install.php. It was observed that no input
  sanitization was provided in the firstname and lastname fields of the
  application. The inse…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: enhancesoft
product: osticket
affected:
  - osticket < 1.10.7
  - 'osticket >= 1.12, < 1.12.1'
patched:
  - osticket 1.12.1
published: '2019-08-07'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-14750'
references:
  - url: >-
      http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    label: cve@mitre.org
  - url: >-
      https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
    label: cve@mitre.org
  - url: 'https://github.com/osTicket/osTicket/releases/tag/v1.10.7'
    label: cve@mitre.org
  - url: 'https://github.com/osTicket/osTicket/releases/tag/v1.12.1'
    label: cve@mitre.org
  - url: 'https://www.exploit-db.com/exploits/47226'
    label: cve@mitre.org
  - url: >-
      http://packetstormsecurity.com/files/154005/osTicket-1.12-Cross-Site-Scripting.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/osTicket/osTicket/commit/c3ba5b78261e07a883ad8fac28c214486c854e12
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/osTicket/osTicket/releases/tag/v1.10.7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/osTicket/osTicket/releases/tag/v1.12.1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.exploit-db.com/exploits/47226'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.10902
epssPercentile: 0.95723
exploitAvailable: true
ingestedAt: '2026-07-10T19:05:51.205Z'
exploits:
  exploitdb: true
  nuclei:
    - CVE-2019-14750
  checkedAt: '2026-09-26T09:05:25.562Z'
---

## Overview

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.

## Affected

- `osticket < 1.10.7`
- `osticket >= 1.12, < 1.12.1`

## Remediation

Upgrade past the affected range:

- `osticket 1.12.1`