CVE-2026-1049

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument TicketID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jan 17, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1049005.3MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field teCVE-2026-1049015.1MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the applicaCVE-2026-1049058.1FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticaCVE-2026-1049066.2MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON contentCVE-2026-1049074.8MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured,CVE-2026-1049087.1MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to creCVE-2026-1049098.1The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (CVE-2026-1049105.3MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a gCVE-2026-1049127.1MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triCVE-2026-1049145.3MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries CVE-2026-1049156.5The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all verCVE-2026-1049328.0The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the rep