Packages / Debian 13 (Trixie) / Source / non-free/web / znuny

Source Package: znuny (6.5.15-2)

Open Ticket Request System Znuny

The following binary packages are built from this source package:

otrs2
Open Ticket Request System Znuny

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-93483] Published: Oct 15, 2026, 3:43:10 AM UTC In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the	Critical(9.5)	Affected Details (2) `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13 `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13
[CVE-2026-77506] Published: Jun 25, 2026, 10:00:00 PM UTC Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.	Medium(4.8)	Affected Details (2) `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13 `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13
[CVE-2026-48188] Published: May 31, 2026, 10:00:00 PM UTC An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue on	Critical(9.1)	Affected Details (2) `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13 `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13
[CVE-2025-26843] Published: May 27, 2026, 10:00:00 PM UTC znuny: CVE-2025-26843	Medium	Affected Details (2) `6.5.15-2` · all · trixie Affected dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Affected dsa · znuny · debian · 13
[CVE-2026-50591] Published: May 27, 2026, 10:00:00 PM UTC In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.	Medium(5.4)	Affected Details (2) `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13 `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13
[CVE-2026-50592] Published: May 27, 2026, 10:00:00 PM UTC In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communication log administration view).	Medium(6.4)	Affected Details (2) `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13 `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13
[CVE-2025-52204] Published: Mar 23, 2026, 8:16:23 PM UTC A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter	Medium(6.1)	Affected Details (2) `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13 `6.5.15-2` · all · trixie Affected nvd · znuny · debian · 13
[CVE-2025-3573] Published: Apr 15, 2025, 5:00:09 AM UTC phpmyadmin: CVE-2025-3573	Medium(6.1)	Affected Details (2) `6.5.15-2` · all · trixie Affected dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Affected dsa · znuny · debian · 13
[CVE-2025-25977] Published: Mar 10, 2025, 12:00:00 AM UTC znuny: CVE-2025-25977	Medium(6.5)	Affected Details (2) `6.5.15-2` · all · trixie Affected dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Affected dsa · znuny · debian · 13

Fixed and unaffected versions (8)

CVE	Severity	Version impact
[CVE-2025-26846] Published: May 12, 2025, 3:15:00 PM UTC znuny: CVE-2025-26846	Medium	Fixed Details (2) `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.13-1` dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.13-1` dsa · znuny · debian · 13
[CVE-2025-26847] Published: May 8, 2025, 5:16:01 PM UTC znuny: CVE-2025-26847	Medium	Fixed Details (2) `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.15-2` dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.15-2` dsa · znuny · debian · 13
[CVE-2025-26845] Published: May 8, 2025, 5:16:00 PM UTC znuny: CVE-2025-26845	Medium	Fixed Details (2) `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.13-1` dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.13-1` dsa · znuny · debian · 13
[CVE-2025-43926] Published: May 8, 2025, 4:15:26 PM UTC znuny: CVE-2025-43926	Medium	Fixed Details (2) `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.15-2` dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.15-2` dsa · znuny · debian · 13
[CVE-2025-26842] Published: May 8, 2025, 4:15:00 PM UTC znuny: CVE-2025-26842	Medium	Fixed Details (2) `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.13-1` dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.13-1` dsa · znuny · debian · 13
[CVE-2025-26844] Published: May 8, 2025, 4:15:00 PM UTC znuny: CVE-2025-26844	Medium	Fixed Details (2) `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.13-1` dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.13-1` dsa · znuny · debian · 13
[CVE-2024-48937] Published: Oct 11, 2024, 9:15:00 PM UTC znuny: CVE-2024-48937	Medium	Fixed Details (2) `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.11-1` dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.11-1` dsa · znuny · debian · 13
[CVE-2024-48938] Published: Oct 11, 2024, 9:15:00 PM UTC znuny: CVE-2024-48938	Medium	Fixed Details (2) `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.11-1` dsa · znuny · debian · 13 `6.5.15-2` · all · trixie Fixed · Fixed: `6.5.11-1` dsa · znuny · debian · 13

Last synced: Oct 28, 2026, 1:40:02 AM UTC

[CVE catalog]

Sources

Debian 13 (Trixie) non-free amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-non-free-amd64:873a1152a9641bbbd32ae06d9bea40c0eb9486caeea340a786d4ab84cb6de6c5
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
non-free/binary-amd64/Packages.xz
Expected SHA-256
873a1152a9641bbbd32ae06d9bea40c0eb9486caeea340a786d4ab84cb6de6c5
Observed SHA-256
873a1152a9641bbbd32ae06d9bea40c0eb9486caeea340a786d4ab84cb6de6c5
Result
match verified
Debian 13 (Trixie) non-free arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-non-free-arm64:6187284b3ec84e045bc98bc85f551b3235a274dc567fa547a853554d18217905
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
non-free/binary-arm64/Packages.xz
Expected SHA-256
6187284b3ec84e045bc98bc85f551b3235a274dc567fa547a853554d18217905
Observed SHA-256
6187284b3ec84e045bc98bc85f551b3235a274dc567fa547a853554d18217905
Result
match verified