CVE-2026-44227: fallo de gravedad media en bestpractical rt
RT: Reflected Cross-Site Scripting via URL parameters
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
bestpractical · rtCVEs relacionadas — bestpractical rt
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-41076HIGHRT: LDAP authentication bypass via empty passwordEPSS 0.4%CVE-2026-41075HIGHRT: SQL injection via entry_aggregator parameter in JSON searchEPSS 0.3%CVE-2026-44228MEDIUMRT: Stored Cross-Site Scripting via insufficient template escapingEPSS 0.3%CVE-2026-44231CRITICALRT: Privilege escalation and information disclosure via REST 2.0 user collection endpointEPSS 0.2%CVE-2026-41073MEDIUMRT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar appsEPSS 0.2%CVE-2026-44230MEDIUMRT: Reflected Cross-Site Scripting in search results chartEPSS 0.2%