Edr4

**Name of the Vulnerable Software and Affected Versions** osticket versions prior to 1.16.6 **Description** The issue is related to Cross-site Scripting (XSS) - Stored. This means that an attacker can inject malicious scripts into the application, which are then stored and executed by the application, potentially allowing the attacker to steal user data or take control of user sessions. **Recommendations** For versions prior to 1.16.6, update to version 1.16.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GLPI versions prior to 10.0.6 **Description** The issue concerns cross-site scripting via malicious RSS feeds. An administrator can import a malicious RSS feed containing Cross Site Scripting (XSS) payloads inside RSS links. When victims visit the RSS content and click on the link, they will execute the Javascript. **Recommendations** For versions prior to 10.0.6, update to version 10.0.6 to resolve the issue. As a temporary workaround, consider restricting the import of RSS feeds from untrusted sources to minimize the risk of exploitation. Avoid clicking on links from RSS feeds that may contain malicious payloads until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** GLPI versions prior to 10.0.3 **Description** The issue is related to the lack of neutralization of HTML tags during web page generation, which can allow a remote attacker to conduct a cross-site scripting attack. The affected versions do not properly neutralize HTML tags in the global search context. **Recommendations** For versions prior to 10.0.3, upgrade to version 10.0.3 to resolve this issue. For users unable to upgrade, disable the global search as a temporary workaround.