{"api_version":"1","generated_at":"2026-05-12T19:27:45+00:00","cve":"CVE-2026-2546","urls":{"html":"https://cve.report/CVE-2026-2546","api":"https://cve.report/api/cve/CVE-2026-2546.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-2546","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-2546"},"summary":{"title":"LigeroSmart index.pl cross site scripting","description":"A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument SortBy leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","state":"PUBLISHED","assigner":"VulDB","published_at":"2026-02-16 09:16:08","updated_at":"2026-04-29 01:00:01"},"problem_types":["CWE-79","CWE-94","CWE-79 Cross Site Scripting","CWE-94 Code Injection"],"metrics":[{"version":"4.0","source":"cna@vuldb.com","type":"Secondary","score":"2","severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"5.1","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","data":{"baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"}},{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"cna@vuldb.com","type":"Secondary","score":"3.5","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"3.5","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","data":{"baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","version":"3.1"}},{"version":"3.0","source":"CNA","type":"DECLARED","score":"3.5","severity":"LOW","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","data":{"baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","version":"3.0"}},{"version":"2.0","source":"cna@vuldb.com","type":"Secondary","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}},{"version":"2.0","source":"CNA","type":"DECLARED","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR","data":{"baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR","version":"2.0"}}],"references":[{"url":"https://vuldb.com/?ctiid.346155","name":"https://vuldb.com/?ctiid.346155","refsource":"cna@vuldb.com","tags":["Permissions Required","VDB Entry"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/LigeroSmart/ligerosmart/issues/283#issue-3879199951","name":"https://github.com/LigeroSmart/ligerosmart/issues/283#issue-3879199951","refsource":"cna@vuldb.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/LigeroSmart/ligerosmart/","name":"https://github.com/LigeroSmart/ligerosmart/","refsource":"cna@vuldb.com","tags":["Product"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/LigeroSmart/ligerosmart/issues/283","name":"https://github.com/LigeroSmart/ligerosmart/issues/283","refsource":"cna@vuldb.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/?id.346155","name":"https://vuldb.com/?id.346155","refsource":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/?submit.749784","name":"https://vuldb.com/?submit.749784","refsource":"cna@vuldb.com","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2546","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2546","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.0","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.1","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.2","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.3","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.4","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.5","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.6","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.7","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.8","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.9","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.10","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.11","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.12","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.13","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.14","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.15","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.16","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.17","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.18","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.19","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.20","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.21","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.22","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.23","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.24","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.25","platforms":[]},{"source":"CNA","vendor":"n/a","product":"LigeroSmart","version":"affected 6.1.26","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-02-15T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"source":"CNA","time":"2026-02-15T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"source":"CNA","time":"2026-02-20T08:22:53.000Z","lang":"en","value":"VulDB entry last update"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Samara Gama - igobysamy (VulDB User)","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"2546","vulnerable":"1","versionEndIncluding":"6.1.26","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ligerosmart","cpe5":"ligerosmart","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-2546","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-02-17T18:30:57.443842Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-02-17T18:31:07.881Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"LigeroSmart","vendor":"n/a","versions":[{"status":"affected","version":"6.1.0"},{"status":"affected","version":"6.1.1"},{"status":"affected","version":"6.1.2"},{"status":"affected","version":"6.1.3"},{"status":"affected","version":"6.1.4"},{"status":"affected","version":"6.1.5"},{"status":"affected","version":"6.1.6"},{"status":"affected","version":"6.1.7"},{"status":"affected","version":"6.1.8"},{"status":"affected","version":"6.1.9"},{"status":"affected","version":"6.1.10"},{"status":"affected","version":"6.1.11"},{"status":"affected","version":"6.1.12"},{"status":"affected","version":"6.1.13"},{"status":"affected","version":"6.1.14"},{"status":"affected","version":"6.1.15"},{"status":"affected","version":"6.1.16"},{"status":"affected","version":"6.1.17"},{"status":"affected","version":"6.1.18"},{"status":"affected","version":"6.1.19"},{"status":"affected","version":"6.1.20"},{"status":"affected","version":"6.1.21"},{"status":"affected","version":"6.1.22"},{"status":"affected","version":"6.1.23"},{"status":"affected","version":"6.1.24"},{"status":"affected","version":"6.1.25"},{"status":"affected","version":"6.1.26"}]}],"credits":[{"lang":"en","type":"reporter","value":"Samara Gama - igobysamy (VulDB User)"}],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument SortBy leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"metrics":[{"cvssV4_0":{"baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"}},{"cvssV3_1":{"baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","version":"3.1"}},{"cvssV3_0":{"baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","version":"3.0"}},{"cvssV2_0":{"baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR","version":"2.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"Cross Site Scripting","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-94","description":"Code Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-02-23T10:07:28.179Z","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB"},"references":[{"name":"VDB-346155 | LigeroSmart index.pl cross site scripting","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/?id.346155"},{"name":"VDB-346155 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/?ctiid.346155"},{"name":"Submit #749784 | LigeroSmart LigeroSmart (OTRS-based platform) 6.1.27 Cross-Site Scripting (XSS) - Reflected XSS","tags":["third-party-advisory"],"url":"https://vuldb.com/?submit.749784"},{"tags":["issue-tracking"],"url":"https://github.com/LigeroSmart/ligerosmart/issues/283"},{"tags":["exploit","issue-tracking"],"url":"https://github.com/LigeroSmart/ligerosmart/issues/283#issue-3879199951"},{"tags":["product"],"url":"https://github.com/LigeroSmart/ligerosmart/"}],"timeline":[{"lang":"en","time":"2026-02-15T00:00:00.000Z","value":"Advisory disclosed"},{"lang":"en","time":"2026-02-15T01:00:00.000Z","value":"VulDB entry created"},{"lang":"en","time":"2026-02-20T08:22:53.000Z","value":"VulDB entry last update"}],"title":"LigeroSmart index.pl cross site scripting"}},"cveMetadata":{"assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","assignerShortName":"VulDB","cveId":"CVE-2026-2546","datePublished":"2026-02-16T08:02:07.017Z","dateReserved":"2026-02-15T16:00:28.877Z","dateUpdated":"2026-02-23T10:07:28.179Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-02-16 09:16:08","lastModifiedDate":"2026-04-29 01:00:01","problem_types":["CWE-79","CWE-94","CWE-79 Cross Site Scripting","CWE-94 Code Injection"],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ligerosmart:ligerosmart:*:*:*:*:*:*:*:*","versionEndIncluding":"6.1.26","matchCriteriaId":"A6446F8A-7F90-4333-A60D-2CAAC185002A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"2546","Ordinal":"1","Title":"LigeroSmart index.pl cross site scripting","CVE":"CVE-2026-2546","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"2546","Ordinal":"1","NoteData":"A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument SortBy leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","Type":"Description","Title":"LigeroSmart index.pl cross site scripting"}]}}}