Vulnerabilidades en bestpractical
13 resultadosAnálisis Vexday
Best Practical registra 13 vulnerabilidades no histórico, com 9 publicadas nos últimos 90 dias, sinalizando atividade recente significativa na base de código. Nenhuma está sob ataque ativo confirmado (KEV), e apenas 1 é crítica, reduzindo a exposição imediata. A fraqueza dominante é XSS (CWE-79), típica de aplicações web, exigindo atenção em validação de entrada mas sem indicar comprometimento em escala neste momento.
CVE-2026-44231CRITICALRT: Privilege escalation and information disclosure via REST 2.0 user collection endpointEPSS 0.4%CVE-2026-41076HIGHRT: LDAP authentication bypass via empty passwordEPSS 0.4%CVE-2026-41075HIGHRT: SQL injection via entry_aggregator parameter in JSON searchEPSS 0.3%CVE-2025-30087HIGHBest Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.EPSS 0.3%CVE-2026-44230MEDIUMRT: Reflected Cross-Site Scripting in search results chartEPSS 0.3%CVE-2026-44227MEDIUMRT: Reflected Cross-Site Scripting via URL parametersEPSS 0.3%CVE-2026-44228MEDIUMRT: Stored Cross-Site Scripting via insufficient template escapingEPSS 0.3%CVE-2026-44229MEDIUMRT: Cross-Site Scripting via inline-served uploaded contentEPSS 0.2%CVE-2025-31501HIGHBest Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.EPSS 0.2%CVE-2025-31500HIGHBest Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.EPSS 0.2%CVE-2025-61873LOWBest Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.EPSS 0.2%CVE-2026-41073MEDIUMRT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar appsEPSS 0.2%CVE-2026-41074HIGHRT has broken CSRF protection for authenticated usersEPSS 0.1%