CVE-2026-1048

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulation of the argument TicketID causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1048009.8The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and heigh CVE-2026-1048019.1The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient CVE-2026-1048039.8The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and CVE-2026-1048058.5DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured b CVE-2026-1048065.5DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. T CVE-2026-1048071.9DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persist CVE-2026-1048081.9DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persist CVE-2026-1048098.4DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of CVE-2026-1048108.4This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication CVE-2026-1048118.4DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the prod CVE-2026-1048147.1Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.CVE-2026-1048168.5Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from conf