CVE-2025-61873
Quick assessment
Affected
bestpractical Request Tracker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Request Tracker是Request Tracker公司的一个问题和工单跟踪系统。 Request Tracker存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-61873
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1236
Source: CVE Program / CVE List V5
Vulnerability Title
Request Tracker 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Request Tracker是Request Tracker公司的一个问题和工单跟踪系统。 Request Tracker存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bestpractical | Request Tracker | 0 ~ 4.4.9 | - |
|
II. Public POCs for CVE-2025-61873
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-61873
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: bestpractical
-
CVE-2026-44230
RT: Reflected Cross-Site Scripting in search results chart -
CVE-2026-44231
RT: Privilege escalation and information disclosure via REST -
CVE-2026-44229
RT: Cross-Site Scripting via inline-served uploaded content -
CVE-2026-44228
RT: Stored Cross-Site Scripting via insufficient template es -
CVE-2026-44227
RT: Reflected Cross-Site Scripting via URL parameters
Same weakness: CWE-1236
-
CVE-2026-55154
EspoCRM: CSV/Formula Injection sanitizer bypass via leading -
CVE-2026-109396
Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injec -
CVE-2026-93581
Insufficient Neutralization of Formula Elements in CSV Expor -
CVE-2026-108579
OpenPanel through 2.3.0 CSV Formula Injection via Cohort Mem -
CVE-2026-100564
OpenClaw before 2026.8.1 CSV Formula Injection via Attendanc
V. Comments for CVE-2025-61873
No comments yet