EUVD-2026-44945
GHSA-pjwj-rcmh-8wvc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS requiring Agent auth (PR:L), victim page-view (UI:R), and scope change to victim session with limited C/I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level privileges to inject malicious payloads into the Notes field of assigned support tickets. Attackers can store malicious scripts that execute in the browser context of any user who views the affected ticket notes, including Superadmin users, enabling session hijacking or unauthorized actions on behalf of the victim.
AnalysisAI
Stored cross-site scripting in Perfect Support Ticketing & Document Management System through version 1.7 allows authenticated Agent-level users to inject persistent malicious scripts into ticket Notes fields. Any user who subsequently views the compromised ticket notes - including Superadmin users - executes the attacker's payload in their browser context, enabling session token theft and unauthorized actions performed on the victim's behalf. No public exploit identified at time of analysis for KEV listing, though a publicly available proof-of-concept exists per VulnCheck and the researcher's GitHub repository.
Technical ContextAI
The vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored (persistent) variant. The affected component is the Notes field within the support ticket workflow of the Perfect Support Ticketing & Document Management System, developed by Ultimate Fosters (CPE: cpe:2.3:a:ultimate_fosters:perfect_support_ticketing_&_document_management_system:*:*:*:*:*:*:*:*). The application fails to sanitize or encode user-supplied input before persisting it to the database and later rendering it in the ticket view. Because the payload is stored server-side, it fires automatically in the browser of every user who loads the affected ticket - including privileged Superadmin accounts - without requiring any additional attacker interaction after initial injection.
RemediationAI
No vendor-released patch has been identified at time of analysis - neither the VulnCheck advisory nor the researcher's disclosure references an official fix version or vendor response. Until a patch is available, organizations should apply the following specific compensating controls: restrict the Agent role assignment strictly to trusted personnel and audit existing Agent accounts for legitimacy, as the attack vector requires Agent-level credentials; implement a Content Security Policy (CSP) header with a restrictive script-src directive to prevent unauthorized script execution, noting this may break legitimate inline scripts in the application; consider deploying a WAF rule targeting script injection patterns in POST bodies destined for the ticket Notes endpoint, accepting the trade-off of possible false positives on legitimate HTML content; and advise Superadmin users to treat ticket notes from external-facing queues as untrusted content until the vendor releases a sanitization fix. Monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/perfect-support-ticketing-system-stored-xss-via-ticket-notes-field) and the researcher's disclosure (https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-63081) for patch release announcements.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today