Vulnerability Description
Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.
CVSS Score
7.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bestpractical | Request Tracker | >= 4.4.0, < 4.4.8 |
Related Weaknesses (CWE)
References
- https://docs.bestpractical.com/release-notes/rt/4.4.8Release Notes
- https://docs.bestpractical.com/release-notes/rt/5.0.8Release Notes
- https://docs.bestpractical.com/release-notes/rt/index.htmlRelease Notes
- https://lists.debian.org/debian-lts-announce/2025/05/msg00009.html
FAQ
What is CVE-2025-30087?
CVE-2025-30087 is a vulnerability with a CVSS score of 7.2 (HIGH). Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.
How severe is CVE-2025-30087?
CVE-2025-30087 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-30087?
Check the references section above for vendor advisories and patch information. Affected products include: Bestpractical Request Tracker.