CVE-2026-1048 MEDIUM

CVE-2026-1048: LigeroSmart index.pl cross site scripting

Vendor N/A
Product LigeroSmart
Weakness CWE-79 · XSS
Published January 17, 2026
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulation of the argument TicketID causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

02Disclosure timeline

January 17, 2026 CVE published
February 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-26567 WordPress Font Awesome WP plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability CVE-2023-29205 org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro CVE-2024-43476 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability CVE-2021-25103 GTranslate < 2.9.7 - Reflected Cross-Site Scripting CVE-2026-53606 sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes