{"id":"CVE-2026-48212","title":"An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.\n\nThis issue affects OTRS:\n\n  *  7.0.X…","summary":"An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.\n\nThis issue affects OTRS:\n\n  *  7.0.X…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"OTRS GmbH (former OTRS AG)","product":"OTRS","affected":["OTRS 7.0.x","OTRS 8.0.x","OTRS 2023.x","OTRS 2024.x","OTRS 2025.x","OTRS >= 2026.x <= 2026.6.x"],"published":"2026-10-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T20:38:44.050","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48212","references":[{"url":"https://otrs.com/release-notes/otrs-security-advisory-2026-11/","label":"security@otrs.com"}],"tags":["nvd","cve.org"],"epss":0.00143,"epssPercentile":0.0354,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T17:51:34.895193Z"},"ingestedAt":"2026-10-12T14:50:34.094Z","slug":"CVE-2026-48212","body":"## Overview\n\nAn OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}