EIP-2026-110406

This exploit demonstrates a stored XSS vulnerability in osTicket 1.9.14 and below by injecting a malicious payload via the X-Forwarded-For header. The payload is stored in the system logs and executed when an administrator views the logs.