Stored XSS via related ticket subject on RTIR Split and Create Incident forms

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority. 

The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• cert.pl/en/posts/2026/10/CVE-2026-105454 Üçüncü taraf
• requesttracker.com/rtir Diğer

Kayıt geçmişi

1. 30 Eki 2026 18:34Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-105456Stored XSS via HTML scrubber rule in RTIR
• 8,0 CVE-2026-120205Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
• 6,1 CVE-2026-104926WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
• 6,4 CVE-2026-107711FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
• 7,2 CVE-2026-120114Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
• 6,1 CVE-2026-100151Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter