A vulnerability was discovered in LigeroSmart up to version 6.1.26. The vulnerable component is an obscured function within the /otrs/index.pl script. By manipulating the SortBy argument, an attacker can inject malicious script content, resulting in reflected cross‑site scripting that can be triggered remotely. This flaw corresponds to CWE‑79 and CWE‑94, allowing an attacker to execute arbitrary JavaScript in the context of legitimate users who visit the affected URL.

Products affected are LigeroSmart, versions up to and including 6.1.26. No specific sub‑versions are listed beyond this upper bound.

The CVSS score of 5.1 indicates a medium severity; EPSS below 1% and absence from the KEV catalog suggests a low probability of widespread exploitation at present. The attack can be launched remotely by supplying a crafted SortBy value in a request to the index.pl endpoint. Although the vulnerability was publicly disclosed, the vendor has not yet released a fix. Systems currently running the affected versions remain vulnerable until a patch or mitigative configuration is applied.