PT-2026-27200 · Unknown · Znuny::Itsm

Published 2026-03-23 · Updated 2026-04-28 · CVE-2025-52204

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Znuny::ITSM versions 6.5.x

Description A Cross-Site Scripting (XSS) issue exists in Znuny::ITSM 6.5.x. The issue is located in the customer.pl API endpoint and is triggered through the OTRSCustomerInterface parameter. This allows for potential malicious script injection.

Recommendations Address the issue in the customer.pl endpoint by sanitizing the OTRSCustomerInterface parameter.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-52204

Affected Products

Znuny::Itsm

References · 11

• 🔥 https://github.com/j0qq3r/CVE-2025-52204 · Exploit
• https://ubuntu.com/security/CVE-2025-52204 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-52204 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-52204 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-52204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52204 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-52204 · Vendor Advisory
• http://znuny.com · Note
• http://znunyitsm.com · Note
• https://znuny.org/en/releases/znuny-lts-6-5-19 · Note
• https://znuny.org/en/releases/znuny-7-3-1 · Note