Product by Debian
Request-tracker4
13 known vulnerabilities in Request-tracker4 (Debian), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-41259 | RT: Information Disclosure | 7.5 | |
| High | CVE-2023-41260 | RT: Information Disclosure | 7.5 | |
| Critical | CVE-2026-44231 | RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint | 9.1 | |
| High | CVE-2026-41075 | RT: SQL injection via entry_aggregator parameter in JSON search | 8.8 | |
| High | CVE-2026-41076 | RT: LDAP authentication bypass via empty password | 8.1 | |
| Medium | CVE-2022-25802 | RT: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2025-30087 | Best Practical RT: Cross-site Scripting | 7.2 | |
| Medium | CVE-2026-6841 | Reflected XSS in Request Tracker | 6.1 | |
| Medium | CVE-2026-44229 | RT: Cross-Site Scripting via inline-served uploaded content | 5.4 | |
| Medium | CVE-2026-41073 | RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps | 4.6 | |
| Medium | CVE-2024-3262 | Information exposure vulnerability in Request Tracker (RT) | 5.5 | |
| Low | CVE-2025-61873 | Best Practical Request Tracker: Improper Neutralization of Formula Elements in a CSV File | 2.6 | |
| Low | CVE-2025-2545 | Deprecated 3DES cryptographic algorithm used by Request Tracker in emails encrypted with S/MIME | — |