{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1049", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-16T16:38:48.292Z", "datePublished": "2026-01-17T17:32:05.916Z", "dateUpdated": "2026-02-26T15:56:50.721Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:33:12.133Z"}, "title": "LigeroSmart index.pl cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "n/a", "product": "LigeroSmart", "versions": [{"version": "6.1.0", "status": "affected"}, {"version": "6.1.1", "status": "affected"}, {"version": "6.1.2", "status": "affected"}, {"version": "6.1.3", "status": "affected"}, {"version": "6.1.4", "status": "affected"}, {"version": "6.1.5", "status": "affected"}, {"version": "6.1.6", "status": "affected"}, {"version": "6.1.7", "status": "affected"}, {"version": "6.1.8", "status": "affected"}, {"version": "6.1.9", "status": "affected"}, {"version": "6.1.10", "status": "affected"}, {"version": "6.1.11", "status": "affected"}, {"version": "6.1.12", "status": "affected"}, {"version": "6.1.13", "status": "affected"}, {"version": "6.1.14", "status": "affected"}, {"version": "6.1.15", "status": "affected"}, {"version": "6.1.16", "status": "affected"}, {"version": "6.1.17", "status": "affected"}, {"version": "6.1.18", "status": "affected"}, {"version": "6.1.19", "status": "affected"}, {"version": "6.1.20", "status": "affected"}, {"version": "6.1.21", "status": "affected"}, {"version": "6.1.22", "status": "affected"}, {"version": "6.1.23", "status": "affected"}, {"version": "6.1.24", "status": "affected"}, {"version": "6.1.25", "status": "affected"}, {"version": "6.1.26", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument TicketID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-16T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-16T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-18T00:39:04.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "chor4o (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.341601", "name": "VDB-341601 | LigeroSmart index.pl cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.341601", "name": "VDB-341601 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.729402", "name": "Submit #729402 | LigeroSmart 6.1.26 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/?submit.746919", "name": "Submit #746919 | LigeroSmart 6.1.27 Cross-Site Scripting vulnerability LigeroSmart version 6.1.27 (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/issues/280", "tags": ["issue-tracking"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/issues/280#issue-3776580352", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T21:33:24.631761Z", "id": "CVE-2026-1049", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:56:50.721Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1049", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T21:33:24.631761Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T21:34:30.637Z"}}], "cna": {"title": "LigeroSmart index.pl cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "chor4o (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "n/a", "product": "LigeroSmart", "versions": [{"status": "affected", "version": "6.1.0"}, {"status": "affected", "version": "6.1.1"}, {"status": "affected", "version": "6.1.2"}, {"status": "affected", "version": "6.1.3"}, {"status": "affected", "version": "6.1.4"}, {"status": "affected", "version": "6.1.5"}, {"status": "affected", "version": "6.1.6"}, {"status": "affected", "version": "6.1.7"}, {"status": "affected", "version": "6.1.8"}, {"status": "affected", "version": "6.1.9"}, {"status": "affected", "version": "6.1.10"}, {"status": "affected", "version": "6.1.11"}, {"status": "affected", "version": "6.1.12"}, {"status": "affected", "version": "6.1.13"}, {"status": "affected", "version": "6.1.14"}, {"status": "affected", "version": "6.1.15"}, {"status": "affected", "version": "6.1.16"}, {"status": "affected", "version": "6.1.17"}, {"status": "affected", "version": "6.1.18"}, {"status": "affected", "version": "6.1.19"}, {"status": "affected", "version": "6.1.20"}, {"status": "affected", "version": "6.1.21"}, {"status": "affected", "version": "6.1.22"}, {"status": "affected", "version": "6.1.23"}, {"status": "affected", "version": "6.1.24"}, {"status": "affected", "version": "6.1.25"}, {"status": "affected", "version": "6.1.26"}]}], "timeline": [{"lang": "en", "time": "2026-01-16T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-16T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-18T00:39:04.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.341601", "name": "VDB-341601 | LigeroSmart index.pl cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.341601", "name": "VDB-341601 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.729402", "name": "Submit #729402 | LigeroSmart 6.1.26 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/?submit.746919", "name": "Submit #746919 | LigeroSmart 6.1.27 Cross-Site Scripting vulnerability LigeroSmart version 6.1.27 (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/issues/280", "tags": ["issue-tracking"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/issues/280#issue-3776580352", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument TicketID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:33:12.133Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1049", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:56:50.721Z", "dateReserved": "2026-01-16T16:38:48.292Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-17T17:32:05.916Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ligerosmart:ligerosmart:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6446F8A-7F90-4333-A60D-2CAAC185002A", "versionEndIncluding": "6.1.26", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument TicketID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en LigeroSmart hasta 6.1.26. El elemento afectado es una funci\u00f3n desconocida del archivo /otrs/index.pl. Dicha manipulaci\u00f3n del argumento TicketID conduce a cross site scripting. Es posible lanzar el ataque remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias pero no ha respondido a\u00fan."}], "id": "CVE-2026-1049", "lastModified": "2026-04-29T01:00:01.613", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2026-01-17T18:15:48.717", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/LigeroSmart/ligerosmart/"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/LigeroSmart/ligerosmart/issues/280"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/LigeroSmart/ligerosmart/issues/280#issue-3776580352"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.341601"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.341601"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.729402"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.746919"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:00:11.948319+00:00", "value": {"mitigation_remediation": ["Upgrade LigeroSmart to a released version that resolves the TicketID handling flaw in \"/otrs/index.pl\".", "If no update is available, patch the existing installation by modifying \"/otrs/index.pl\" to sanitize or validate the TicketID parameter before rendering it.", "Check the LigeroSmart vendor website or support forums for any new patch release and apply it promptly.", "Restrict access to the TicketID parameter or the /otrs/index.pl endpoint using web\u2011application firewall rules or by disabling unnecessary functionality exposed through the URL."], "summary": {"action": "Apply Patch", "impact": "Remote Client\u2011Side Code Execution (Reflected XSS via TicketID)"}, "threat_synthesis": {"affected_systems": "As of the current information, all installations of LigeroSmart up to and including version 6.1.26 are vulnerable. The flaw is not tied to a specific deployment configuration, so any web server hosting the application and exposing the /otrs/index.pl endpoint is at risk.", "description_and_impact": "A cross\u2011site scripting vulnerability exists in the LigeroSmart application within a function of the \"/otrs/index.pl\" file. Manipulation of the TicketID argument allows an attacker to inject arbitrary HTML or JavaScript. The injected script will execute in the victim\u2019s browser under the context of their session; however, the description does not explicitly state the consequences, so any potential for session hijacking, defacement, or other client\u2011side exploitation is inferred based on standard XSS behaviors.", "risk_and_exploitability": "The CVSS score of 5.1 categorizes this as moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild at present. LigeroSmart is not listed in CISA KEV. The vulnerability can be exploited remotely by delivering a crafted URL containing a malicious TicketID value; no privileged local access is required. As no official patch has been issued yet, administrators should monitor the vendor\u2019s website or support channels for an update, consider applying a temporary workaround by sanitizing the TicketID parameter, and optionally limit exposure through web\u2011application firewall rules."}}}}, "created": "2026-01-19T09:19:17.862140+00:00", "updated": "2026-04-18T16:15:04.590631+00:00", "vendors": ["ligerosmart", "ligerosmart$PRODUCT$ligerosmart"]}