In Znuny LTS before 6.5.21 and Znuny before 7.3.3 the admin view for communication logs fails to escape user input, enabling a reflected XSS attack. Injected script is executed in the context of the administrative interface, potentially allowing an attacker to hijack user sessions, steal credentials, or run arbitrary code in the victim’s browser. The flaw is categorized as CWE‑79.

The vulnerability applies to the Znuny ticketing system. Users who have not upgraded beyond Znuny LTS 6.5.21 or the generic Znuny 7.3.3 release are affected. Any installation running these earlier versions is at risk.

The CVSS score of 6.4 indicates moderate risk, with no EPSS score available and no listing in the CISA KEV catalog. Exploitation requires access to the administrative interface; thus an attacker must have authenticated administrative privileges or must convince a privileged user to consume a crafted link. The attack vector is therefore authenticated or social‑engineering based, and the impact occurs within the victim’s browser session.