Znuny Vulnerability Allows Remote Cross-Site Scripting Attack
Summary
CERT-Bund has issued a security advisory regarding a vulnerability in Znuny, an open-source ticketing software. The vulnerability allows remote attackers to perform a Cross-Site Scripting (XSS) attack. Affected versions include Znuny LTS <6.5.19 and Znuny <7.3.1.
What changed
CERT-Bund has released a security advisory (WID-SEC-2026-0826) detailing a critical vulnerability in the open-source ticketing software Znuny. The vulnerability, identified with a CVSS Base Score of 6.1, allows remote, anonymous attackers to exploit a flaw to conduct Cross-Site Scripting (XSS) attacks. This affects Znuny LTS versions prior to 6.5.19 and Znuny versions prior to 7.3.1, impacting Linux and UNIX operating systems.
Organizations using affected versions of Znuny must take immediate action to mitigate this risk. It is recommended to update to the patched versions (Znuny LTS >= 6.5.19 or Znuny >= 7.3.1) as soon as possible. Failure to do so could expose systems to unauthorized data access or manipulation through XSS attacks, potentially compromising sensitive ticket information and user credentials.
What to do next
- Update Znuny LTS to version 6.5.19 or later
- Update Znuny to version 7.3.1 or later
- Review system logs for signs of exploitation
Archived snapshot
Mar 24, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-0826] Znuny: Schwachstelle ermöglicht Cross-Site Scripting CVSS Base Score 6.1 (mittel) CVSS Temporal Score 5.5 (mittel) Remoteangriff ja Datum 23.03.2026 Stand 24.03.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Linux
- UNIX
Produktbeschreibung
Znuny ist eine Open Source Ticketing Software.
Produkte
23.03.2026
- Znuny Znuny LTS <6.5.19
- Znuny Znuny <7.3.1
Angriff
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Znuny ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Named provisions
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The plain-English summary, classification, and "what to do next" steps are AI-generated from the original text. Cite the source document, not the AI analysis.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.