Bestpractical vulnerabilities
76 vulnerabilities
Known vulnerabilities in Bestpractical products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5- Rt48 vulnerabilities
- Request Tracker33 vulnerabilities
- Request Tracker For Incident Response2 vulnerabilities
- Rt Extension Mobileui1 vulnerabilities
- Rtfm1 vulnerabilities
CVE-2018-18898alpineperl-email-address-list+6
EPSS score2.36%
The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.CVE-2013-5587bestpracticalrt+2EPSS score1.98%
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.CVE-2013-3525bestpracticalrequest_tracker+1EPSS score2.81%
SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.CVE-2013-3372bestpracticalrt+2EPSS score2.06%
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors.CVE-2013-3371bestpracticalrt+1EPSS score2.06%
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment.CVE-2013-3370bestpracticalrt+2EPSS score2.32%
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.CVE-2013-3369bestpracticalrt+2EPSS score1.23%
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors.CVE-2013-3736bestpracticalrequest_tracker+1EPSS score1.16%
Cross-site scripting (XSS) vulnerability in the MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the name of an attached file.CVE-2013-3737bestpracticalrequest_trackerEPSS score1.44%
The MobileUI (aka RT-Extension-MobileUI) extension before 1.04 in Request Tracker (RT) 4.0.0 before 4.0.13, when using the file-based session store (Apache::Session::File) and certain authentication extensions, allows remote attackers to reuse unauthorized sessions and obtain user preferences and caches via unspecified vectors.CVE-2013-3374bestpracticalrt+2EPSS score1.41%
Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."CVE-2013-3368bestpracticalrt+2EPSS score0.35%
bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.CVE-2013-3373bestpracticalrt+2EPSS score2.43%
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.CVE-2021-38562bestpracticalrequest_tracker+6EPSS score1.84%
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.CVE-2015-1464bestpracticalrequest_tracker+2EPSS score1.99%
RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.CVE-2015-1165bestpracticalrequest_tracker+3EPSS score2.12%
RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.CVE-2015-5475bestpracticalrequest_tracker+2EPSS score2.08%
Multiple cross-site scripting (XSS) vulnerabilities in Request Tracker (RT) 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) user and (2) group rights management pages.CVE-2015-6506bestpracticalrequest_tracker+2EPSS score2.08%
Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key.CVE-2016-6127bestpracticalrequest_tracker+2EPSS score1.20%
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.CVE-2025-61873bestpracticalrequest_tracker+3EPSS score0.22%
Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.CVE-2025-31501bestpracticalrequest_tracker+3EPSS score0.24%
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.