CVE-2026-63081

Name of the Vulnerable Software and Affected Versions Perfect Support Ticketing & Document Management System versions prior to 1.8

Description Stored cross-site scripting occurs when authenticated attackers with Agent-level privileges inject malicious payloads into the Notes field of assigned support tickets. These scripts execute within the browser context of any user viewing the affected notes, including Superadmin users, potentially leading to session hijacking or unauthorized actions performed on behalf of the victim.

Recommendations Update to a version newer than 1.7. Restrict the use of the Notes field for Agent-level users until the system is updated.