CVE-2019-1010018CWE-80

CVE-2019-1010018: vulnerability in Zammad

Published · Updated

Follow this CVE+ Monitor zammad

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.3%
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.
Affected products
Zammad GmbH · Zammad
Related CVEs — Zammad

In the same product, most dangerous first.

CVE-2026-102489HIGHUndisclosed RCE in Zammad v6.3 and higherEPSS 22.5%KEVCVE-2026-102490HIGHLocal privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM packageEPSS 10.9%KEV