A cross‑site scripting vulnerability is present in Znuny::ITSM 6.5.x within the customer.pl endpoint when the OTRSCustomerInterface parameter is used. The flaw allows an attacker to embed malicious JavaScript into the page without proper input sanitization. If executed in a victim's browser, the script could read cookies, hijack sessions, or perform actions on behalf of the user, thereby compromising confidentiality and integrity of user accounts and potentially allowing further attacks.

The affected product is Znuny::ITSM 6.5.x, as noted in the advisory. No earlier or later version information is available, so all releases within the 6.5.x series should be treated as vulnerable until an update is released by the developers.

The vulnerability scores CVSS 6.1 with an EPSS of less than 1%, indicating low current exploitation probability. It is not listed in the CISA KEV catalog. Because the flaw is accessed via HTTP requests to the customer.pl page, any user with web access could attempt exploitation. While the current threat level is moderate, administrators should patch or apply mitigations promptly.