osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.

Published Aug 26, 2020 · Updated Aug 4, 2024 · Assigned by mitre