A flaw in LigeroSmart allows attackers to manipulate the TicketID argument at /otrs/index.pl?Action=AgentTicketZoom, injecting arbitrary client‑side scripts. This results in cross‑site scripting (CWE‑79) and code execution of potential malicious payloads (CWE‑94). Attackers can embed JavaScript that executes in the browsers of any user who views the crafted URL, enabling session hijacking, credential theft, or page tampering. The vulnerability is triggered remotely by sending a specially crafted web request, a conclusion inferred from the description that the exploit works via the TicketID parameter.

LigeroSmart installations running version 6.1.26 or earlier are affected. No newer releases have been reported as vulnerable and the vendor has yet to issue a fix or update.

The CVSS score of 5.1 classifies the issue as medium severity. Coupled with an EPSS score of less than 1 % and absence from the CISA KEV catalog, the current risk is relatively low, yet the publicly available exploit means any user who visits the malicious link could be compromised. The attack vector is a remote HTTP request to the web application, inferred from the description that the flaw is triggered via a crafted URL.