A vulnerable Bootstrap Tooltip component in osTicket coupled with inadequate HTML filtering creates a stored cross‑site scripting flaw. The flaw permits attackers to embed malicious JavaScript that is later executed within the browser context of an Agent or Administrator who views the compromised content.

Versions 1.10 through 1.17.7 and 1.18.0 through 1.18.3 of osTicket are impacted.

The CVSS score of 5.4 indicates moderate severity, while an EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The attack does not require any privileged access; it relies on the injection of user‑controlled content that is stored and later rendered. When an Agent or Admin opens the affected ticket or comment, the embedded script runs with the privileges of that user, potentially allowing modification of ticket data, session hijacking within the application, or further distribution of malicious content. The likely attack vector is stored XSS, inferred from the description that the flaw stems from unsanitized data processed by the tooltip component.