A cross‑site scripting vulnerability exists in the LigeroSmart application within a function of the "/otrs/index.pl" file. Manipulation of the TicketID argument allows an attacker to inject arbitrary HTML or JavaScript. The injected script will execute in the victim’s browser under the context of their session; however, the description does not explicitly state the consequences, so any potential for session hijacking, defacement, or other client‑side exploitation is inferred based on standard XSS behaviors.

As of the current information, all installations of LigeroSmart up to and including version 6.1.26 are vulnerable. The flaw is not tied to a specific deployment configuration, so any web server hosting the application and exposing the /otrs/index.pl endpoint is at risk.

The CVSS score of 5.1 categorizes this as moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild at present. LigeroSmart is not listed in CISA KEV. The vulnerability can be exploited remotely by delivering a crafted URL containing a malicious TicketID value; no privileged local access is required. As no official patch has been issued yet, administrators should monitor the vendor’s website or support channels for an update, consider applying a temporary workaround by sanitizing the TicketID parameter, and optionally limit exposure through web‑application firewall rules.