Samara Gama

**Name of the Vulnerable Software and Affected Versions** LigeroSmart versions up to 6.1.26 **Description** A flaw exists in LigeroSmart that allows for cross site scripting. The issue is related to the manipulation of the `Profile` argument within the `/otrs/index.pl?Action=AgentTicketSearch` API endpoint. The exploit has been publicly released and could be used for attacks. The project was notified of the issue but has not yet responded. **Recommendations** Versions prior to 6.1.26 should be updated.

**Name of the Vulnerable Software and Affected Versions** LigeroSmart versions up to 6.1.26 **Description** A flaw exists in LigeroSmart that allows for cross site scripting. The issue is located in the `AgentDashboard` function within the `/otrs/index.pl` file. Manipulating the `Subaction` argument can trigger the flaw, potentially allowing for remote exploitation. The exploit is publicly available. **Recommendations** Versions prior to 6.1.26 should be updated. As a temporary workaround, consider restricting or disabling the `AgentDashboard` function until a patch is available.