CVE-2026-102372

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.62

Description Insufficient sanitization of HTML email bodies within the IMAP LOGIN connector allows unauthenticated attackers to perform a stored cross-site scripting attack. By sending emails to the monitored mailbox containing script tags and event handlers, attackers can inject arbitrary JavaScript into ticket descriptions and replies. This script executes in the browsers of technicians viewing the tickets, potentially leading to the theft of ticket data and the execution of unauthorized actions.

Recommendations Update GestSup to version 3.2.62 or later.