CVE-2025-10692
OpenSupports 4.11.0
- Class
- SQLi
- Severity
- High · CVSS 4.0 score 7.1
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- tito
- Affected
- OpenSupports 4.11.0
The defect
SQL injection (staff get-new-tickets)
Class overview · SQLi
User-controlled text reaches a SQL query without being separated from the query structure. The attacker can read or change data beyond the intended filter; the exact set depends on the query and the database permissions behind it.