Packages / Debian 12 (Bookworm) / Source / non-free/web / znuny

Source Package: znuny (6.5.1-1)

Open Ticket Request System Znuny

The following binary packages are built from this source package:

otrs2
Open Ticket Request System Znuny

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-93484] Published: Oct 15, 2026, 3:50:36 AM UTC Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries	High(8.6)	Affected Details (2) `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm
[CVE-2026-93483] Published: Oct 15, 2026, 3:43:10 AM UTC In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the	Critical(9.5)	Affected Details (2) `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12
[CVE-2026-77506] Published: Jun 25, 2026, 10:00:00 PM UTC Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.	Medium(4.8)	Affected Details (2) `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12
[CVE-2026-48188] Published: May 31, 2026, 10:00:00 PM UTC An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue on	Critical(9.1)	Affected Details (2) `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12
[CVE-2025-26843] Published: May 27, 2026, 10:00:00 PM UTC znuny: CVE-2025-26843	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2026-50591] Published: May 27, 2026, 10:00:00 PM UTC In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.	Medium(5.4)	Affected Details (2) `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12
[CVE-2026-50592] Published: May 27, 2026, 10:00:00 PM UTC In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communication log administration view).	Medium(6.4)	Affected Details (2) `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12
[CVE-2025-52204] Published: Mar 23, 2026, 8:16:23 PM UTC A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter	Medium(6.1)	Affected Details (2) `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected nvd · znuny · debian · bookworm; nvd · znuny · debian · 12
[CVE-2025-26846] Published: May 12, 2025, 3:15:00 PM UTC znuny: CVE-2025-26846	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2025-26847] Published: May 8, 2025, 5:16:01 PM UTC znuny: CVE-2025-26847	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2025-26845] Published: May 8, 2025, 5:16:00 PM UTC znuny: CVE-2025-26845	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2025-43926] Published: May 8, 2025, 4:15:26 PM UTC znuny: CVE-2025-43926	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2025-26842] Published: May 8, 2025, 4:15:00 PM UTC znuny: CVE-2025-26842	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2025-26844] Published: May 8, 2025, 4:15:00 PM UTC znuny: CVE-2025-26844	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2025-3573] Published: Apr 15, 2025, 5:00:09 AM UTC phpmyadmin: CVE-2025-3573	Medium(6.1)	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2025-25977] Published: Mar 10, 2025, 12:00:00 AM UTC znuny: CVE-2025-25977	Medium(6.5)	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2024-48937] Published: Oct 11, 2024, 9:15:00 PM UTC znuny: CVE-2024-48937	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12
[CVE-2024-48938] Published: Oct 11, 2024, 9:15:00 PM UTC znuny: CVE-2024-48938	Medium	Affected Details (2) `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12 `6.5.1-1` · all · bookworm Affected dsa · znuny · debian · bookworm; dsa · znuny · debian · 12

Fixed and unaffected versions (2)

CVE Severity Version impact

CVE	Severity	Version impact
[CVE-2022-4427] Published: Dec 18, 2022, 11:00:00 PM UTC znuny: CVE-2022-4427	Medium	Fixed Details (2) `6.5.1-1` · all · bookworm Fixed · Fixed: `6.4.5-1` dsa · znuny · debian · bookworm `6.5.1-1` · all · bookworm Fixed · Fixed: `6.4.5-1` dsa · znuny · debian · bookworm
[CVE-2021-36100] Published: Mar 20, 2022, 11:00:00 PM UTC znuny: CVE-2021-36100	Low	Not affected Details (2) `6.5.1-1` · all · bookworm Not affected dsa · znuny · debian · bookworm `6.5.1-1` · all · bookworm Not affected dsa · znuny · debian · bookworm

[CVE-2022-4427]

Published: Dec 18, 2022, 11:00:00 PM UTC

znuny: CVE-2022-4427

Medium

Fixed

Details (2)

6.5.1-1 · all · bookworm
Fixed · Fixed: 6.4.5-1
dsa · znuny · debian · bookworm
6.5.1-1 · all · bookworm
Fixed · Fixed: 6.4.5-1
dsa · znuny · debian · bookworm

[CVE-2021-36100]

Published: Mar 20, 2022, 11:00:00 PM UTC

znuny: CVE-2021-36100

Low

Not affected

Details (2)

6.5.1-1 · all · bookworm
Not affected
dsa · znuny · debian · bookworm
6.5.1-1 · all · bookworm
Not affected
dsa · znuny · debian · bookworm

[Next results]

Last synced: Oct 28, 2026, 1:40:02 AM UTC

[CVE catalog]

Sources

Debian 12 (Bookworm) non-free amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-non-free-amd64:8aacd1cb81b47407a43a8fa6a59b8de3da5e0336f612f7e9245d4ea380b8a49d
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
non-free/binary-amd64/Packages.xz
Expected SHA-256
8aacd1cb81b47407a43a8fa6a59b8de3da5e0336f612f7e9245d4ea380b8a49d
Observed SHA-256
8aacd1cb81b47407a43a8fa6a59b8de3da5e0336f612f7e9245d4ea380b8a49d
Result
match verified
Debian 12 (Bookworm) non-free arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-non-free-arm64:5f70e8e31d64f9241904e54a83dc639d92f4eea9ad1a57b26d40f3943f474929
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
non-free/binary-arm64/Packages.xz
Expected SHA-256
5f70e8e31d64f9241904e54a83dc639d92f4eea9ad1a57b26d40f3943f474929
Observed SHA-256
5f70e8e31d64f9241904e54a83dc639d92f4eea9ad1a57b26d40f3943f474929
Result
match verified