CVE-2026-2547

Katalog CVE

CVSS 6.1 · Medium EPSS 0,45%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ligerosmart. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in LigeroSmart up to 6.1.26. The impacted element is the function AgentDashboard of the file /otrs/index.pl. Performing a manipulation of the argument Subaction results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD

16 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 36,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/LigeroSmart/ligerosmart/issues/284 exploit · issue tracking · advisory pihak ketiga
• https://github.com/LigeroSmart/ligerosmart/issues/284#issue-3879280231 exploit · issue tracking · advisory pihak ketiga
• https://vuldb.com/?id.346156 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.749788 exploit · advisory pihak ketiga · vdb entry
• https://github.com/LigeroSmart/ligerosmart/ product
• https://vuldb.com/?ctiid.346156 permissions required · vdb entry