Request Tracker
Vendor:
First CVE: May 10, 2013 · Active for 13 years
29
Total CVEs
More Total CVEs than 96% of tracked products
2.9
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
6.0
Avg CVSS
Higher Avg CVSS than 21% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Request Tracker over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 10, 2013
13 years ago
Most Recent CVE
May 21, 2026
64 days ago
CVE Severity & Scoring
Request Tracker29 CVEs
66%
31%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network17 (58.6%)
Unknown12 (41.4%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (51.7%)
High2 (6.9%)
Unknown12 (41.4%)
User Interaction
None7 (24.1%)
Unknown12 (41.4%)
Required9 (31.0%)
Privileges Required
Low1 (3.4%)
High1 (3.4%)
None15 (51.7%)
Unknown12 (41.4%)
Top CVEs
Signals from CVEs in this product scope (29 CVEs).
29 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-3525HIGH SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: | May 10, 2013 | 7.5 | 29 | NO | YES |
CVE-2026-6841MEDIUM Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, resul | May 21, 2026 | 6.1 | 26 | NO | NO |
CVE-2021-38562HIGH Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middl | Oct 18, 2021 | 7.5 | 25 | NO | NO |
CVE-2018-18898HIGH The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address | Mar 21, 2019 | 7.5 | 24 | NO | NO |
CVE-2023-41259HIGH Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST | Nov 3, 2023 | 7.5 | 22 | NO | NO |
CVE-2017-5944HIGH The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain priv | Jul 3, 2017 | 8.8 | 22 | NO | NO |
CVE-2017-5943HIGH Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information about cross-site request forgery (CSRF) | Jul 3, 2017 | 8.8 | 22 | NO | NO |
CVE-2025-9158MEDIUM The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulne | Oct 24, 2025 | 5.3 | 21 | NO | NO |
CVE-2022-25803MEDIUM Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. | Jul 14, 2022 | 6.1 | 21 | NO | NO |
CVE-2022-25802MEDIUM Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment. | Jul 14, 2022 | 6.1 | 21 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (29 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
3.4% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (29 CVEs).
Media Mentions
Signals from CVEs in this product scope (29 CVEs).
Top CNAs Publishing CVEs For Request Tracker
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.4.1 | 4 | 7.4 | 1.6% | 0 | 0 |
| 4.4.0 | 4 | 7.4 | 1.6% | 0 | 0 |
| 4.2.9 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.8 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.7 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.6 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.5 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.4 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.3 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.2 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.13 | 4 | 7.4 | 1.6% | 0 | 0 |
| 4.2.12 | 4 | 7.4 | 1.6% | 0 | 0 |
| 4.2.11 | 4 | 7.4 | 1.6% | 0 | 0 |
| 4.2.10 | 4 | 7.4 | 1.6% | 0 | 0 |
| 4.2.1 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.2.0 | 7 | 6.9 | 1.9% | 0 | 0 |
| 4.0.9 | 8 | 6.4 | 1.7% | 0 | 0 |
| 4.0.8 | 9 | 6.5 | 1.8% | 0 | 1 |
| 4.0.7 | 13 | 6.0 | 1.6% | 0 | 1 |
| 4.0.6 | 13 | 6.0 | 1.6% | 0 | 1 |