CVE-2026-41075highCWE-89

CVE-2026-41075: falha de alta gravidade em bestpractical rt

RT: SQL injection via entry_aggregator parameter in JSON search

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rt+ Monitorar request-tracker4

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.3%
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by restricting RT account access to trusted users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
bestpractical · rt
CVEs relacionadas — bestpractical rt

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41076HIGHRT: LDAP authentication bypass via empty passwordEPSS 0.4%CVE-2026-44227MEDIUMRT: Reflected Cross-Site Scripting via URL parametersEPSS 0.3%CVE-2026-44228MEDIUMRT: Stored Cross-Site Scripting via insufficient template escapingEPSS 0.3%CVE-2026-44231CRITICALRT: Privilege escalation and information disclosure via REST 2.0 user collection endpointEPSS 0.2%CVE-2026-41073MEDIUMRT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar appsEPSS 0.2%CVE-2026-44230MEDIUMRT: Reflected Cross-Site Scripting in search results chartEPSS 0.2%