Bestpractical
Bestpractical RT: vulnerabilities and CVEs
Bestpractical RT has 41 published vulnerabilities, 3 of them in the last 12 months. 0 are rated critical and 0 are listed by CISA as actively exploited.
CVEs41
Last 12 months3
Critical0
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-41076 | High (8.1) | 0.66% | — | May 22, 2026 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD… |
| CVE-2026-41075 | High (8.8) | 0.48% | — | May 22, 2026 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is… |
| CVE-2026-41073 | Medium (4.6) | 0.29% | — | May 22, 2026 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet… |
| CVE-2024-3262 | Medium (5.5) | 0.29% | — | Apr 4, 2024 | Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as… |
| CVE-2024-29916 | Medium (5.6) | 0.32% | — | Mar 21, 2024 | The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the… |
| CVE-2014-1474 | Medium (5) | 2.4% | — | Jul 15, 2014 | Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address. |
| CVE-2013-5587 | Low (2.6) | 2.0% | — | Aug 23, 2013 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket. NOTE: this issue… |
| CVE-2013-3374 | Medium (4.3) | 1.4% | — | Aug 23, 2013 | Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user… |
| CVE-2013-3373 | Medium (5) | 2.4% | — | Aug 23, 2013 | CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header. |
| CVE-2013-3372 | Medium (4.3) | 2.1% | — | Aug 23, 2013 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified… |
| CVE-2013-3371 | Medium (4.3) | 2.1% | — | Aug 23, 2013 | Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment. |
| CVE-2013-3370 | Medium (6.8) | 2.3% | — | Aug 23, 2013 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request. |
| CVE-2013-3369 | Medium (6) | 1.2% | — | Aug 23, 2013 | Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors. |
| CVE-2013-3368 | Low (3.3) | 0.35% | — | Aug 23, 2013 | bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name. |
| CVE-2012-4733 | Medium (6) | 1.6% | — | Aug 23, 2013 | Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets… |
| CVE-2012-4884 | Medium (5) | 1.6% | — | Nov 11, 2012 | Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client. |
| CVE-2012-4734 | Medium (5) | 1.8% | — | Nov 11, 2012 | Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state"… |
| CVE-2012-4732 | Medium (6.8) | 0.87% | — | Nov 11, 2012 | Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users… |
| CVE-2012-4730 | Low (3.5) | 1.3% | — | Nov 11, 2012 | Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain… |
| CVE-2011-5093 | Medium (6.5) | 2.1% | — | Jun 4, 2012 | Best Practical Solutions RT 4.x before 4.0.6 does not properly implement the DisallowExecuteCode option, which allows remote authenticated users to bypass intended access restrictions and execute arbitrary code by… |
| CVE-2011-5092 | High (7.5) | 2.8% | — | Jun 4, 2012 | Best Practical Solutions RT 3.8.x before 3.8.12 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code and gain privileges via unspecified vectors, a different vulnerability than CVE-2011-4458 and… |
| CVE-2011-4460 | Medium (6.5) | 1.8% | — | Jun 4, 2012 | SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to a privileged account. |
| CVE-2011-4459 | Low (3.5) | 1.0% | — | Jun 4, 2012 | Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by… |
| CVE-2011-4458 | Medium (6.8) | 3.1% | — | Jun 4, 2012 | Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors,… |
| CVE-2011-2085 | Medium (6.8) | 1.1% | — | Jun 4, 2012 | Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users. |
| CVE-2011-2084 | Medium (4) | 1.7% | — | Jun 4, 2012 | Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to read (1) hashes of former passwords and (2) ticket correspondence history by leveraging access to a privileged… |
| CVE-2011-2083 | Medium (4.3) | 1.8% | — | Jun 4, 2012 | Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-2082 | Medium (5) | 1.2% | — | Jun 4, 2012 | The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent… |
| CVE-2011-1690 | Medium (4.3) | 2.4% | — | Apr 22, 2011 | Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors. |
| CVE-2011-1689 | Medium (4.3) | 2.3% | — | Apr 22, 2011 | Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML… |