CVE-2026-63081

MEDIUM 5.4

Perfect Support Ticketing System 1.7 Stored XSS via Ticket Notes Field

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level privileges to inject malicious payloads into the Notes field of assigned support tickets. Attackers can store malicious scripts that execute in the browser context of any user who views the affected ticket notes, including Superadmin users, enabling session hijacking or unauthorized actions on behalf of the victim.

CWE	CWE-79
Vendor	ultimate fosters
Product	perfect support ticketing & document management system
Published	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for ultimate fosters perfect support ticketing & document management system

Be the first to know when new medium vulnerabilities affecting ultimate fosters perfect support ticketing & document management system are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Ultimate Fosters / Perfect Support Ticketing & Document Management System

0 ≤ 1.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-63081 vulncheck.com: https://www.vulncheck.com/advisories/perfect-support-ticketing-system-stored-xss-via-ticket-notes-field

Credits

Aaron Amran Bin Amiruddin Shahrul Nizam Bin Shahrin