CVE-2026-63081
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Perfect Support Ticketing & Document Management System through version 1.7 contains a stored cross-site scripting vulnerability. Authenticated attackers with Agent-level privileges can inject malicious payloads into the Notes field of assigned support tickets, which execute in the browser context of any user viewing those notes, including Superadmin users.
Risk Assessment
The risk includes session hijacking or unauthorized actions performed on behalf of the victim, potentially compromising the confidentiality and integrity of data within the ticketing system.
Recommendation
It is recommended to immediately update the system to the latest version and implement input filtering and encoding for the Notes field to prevent script injection.
Other vulnerabilities in Perfect Support Ticketing & Document Management System
Original NVD description (English source)
Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level privileges to inject malicious payloads into the Notes field of assigned support tickets. Attackers can store malicious scripts that execute in the browser context of any user who views the affected ticket notes, including Superadmin users, enabling session hijacking or unauthorized actions on behalf of the victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS