CVE-2026-2547

LOW

ligerosmart < 6.1.26 - Cross-Site Scripting via Subaction Parameter in AgentDashboard

Title source: llm
STIX 2.1

Description

A vulnerability was detected in LigeroSmart up to 6.1.26. The impacted element is the function AgentDashboard of the file /otrs/index.pl. Performing a manipulation of the argument Subaction results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.346156
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.346156
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.749788

Scores

CVSS v3 3.5
EPSS 0.0002
EPSS Percentile 5.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
ligerosmart/ligerosmart < 6.1.26
Published Feb 16, 2026
Tracked Since Feb 18, 2026