CVE-2026-63081 is a stored cross-site scripting vulnerability in Ultimate Fosters Perfect Support Ticketing & Document Management System through version 1.7. It allows authenticated attackers with Agent-level privileges to inject malicious JavaScript payloads into the Notes field of assigned support tickets. When other users, including Superadmins, view these notes, the malicious scripts execute in their browser context. This can lead to session hijacking or unauthorized actions performed on behalf of the victim. The vulnerability requires authentication and user interaction (viewing the notes). The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and partial user interaction. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated Agent-level user to store malicious scripts that execute in the browsers of users viewing the affected ticket notes, including high-privilege Superadmin users. This can result in session hijacking or unauthorized actions performed with the victim's privileges. The vulnerability does not allow unauthenticated remote code execution but poses a risk to user sessions and data integrity within the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Agent-level user privileges to trusted personnel only and consider restricting access to the Notes field or sanitizing input at the application layer if possible. Monitor for suspicious activity related to ticket notes. No vendor-provided mitigation or temporary fix is currently documented.