A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument TicketID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
[POC] CVE-2026-104905 — CVE-2026-104905-facturascripts-object-injection
PHP Object Injection -> Arbitrary File Deletion in FacturaScripts <= 2026.66 (CWE-502). PoC + advisory.
[POC] CVE-2026-104991 — CVE-2026-104991
CVE-2026-104991 — Missing Authorization (BOLA/IDOR) in Phproject REST API read/comment endpoints
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free