An improper handling of the Profile query parameter in the /otrs/index.pl?Action=AgentTicketSearch endpoint of LigeroSmart allows an attacker to inject arbitrary JavaScript into the generated web page. This cross‑site scripting flaw enables a remotely triggered attack that can be executed by visiting a crafted link. Because the victim’s browser executes the payload, potential consequences include session hijacking, credential theft, or malicious interaction with the application. The flaw is classified as CWE‑79 and also involves CWE‑94 characteristics related to code injection through parameter manipulation.

LigeroSmart products up to version 6.1.26 are affected. The vulnerability is present in all releases of version 6.1.26 and earlier.

The CVSS base score of 5.1 places the issue in the medium severity range. The EPSS score is lower than 1%, indicating a very low current exploitation possibility. The vulnerability is not listed in the CISA KEV catalog, so no confirmed attacks are reported. Attackers can trigger the flaw remotely by constructing a URL that includes a malicious value for the Profile parameter. Publicly available exploit code suggests that threat actors could deploy the attack once a fix is not applied.