CVE-2026-44230: falha de média gravidade em bestpractical rt
RT: Reflected Cross-Site Scripting in search results chart
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.3%
probabilidade de exploração
0.3%top 83% das CVEs
exploração observada
nãonenhuma fonte reporta
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
bestpractical · rtCVEs relacionadas — bestpractical rt
No mesmo produto, das mais perigosas para as menos.
CVE-2026-41076HIGHRT: LDAP authentication bypass via empty passwordEPSS 0.7%CVE-2026-41075HIGHRT: SQL injection via entry_aggregator parameter in JSON searchEPSS 0.5%CVE-2026-44231CRITICALRT: Privilege escalation and information disclosure via REST 2.0 user collection endpointEPSS 0.4%CVE-2026-41073MEDIUMRT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar appsEPSS 0.3%CVE-2026-44227MEDIUMRT: Reflected Cross-Site Scripting via URL parametersEPSS 0.3%CVE-2026-44228MEDIUMRT: Stored Cross-Site Scripting via insufficient template escapingEPSS 0.3%