CVE-2026-63081 is a stored cross-site scripting vulnerability in Ultimate Fosters Perfect Support Ticketing & Document Management System through version 1.7. It allows authenticated attackers with Agent-level privileges to inject malicious JavaScript payloads into the Notes field of assigned support tickets. When other users, including those with Superadmin privileges, view these notes, the malicious scripts execute in their browser context. This can lead to session hijacking or unauthorized actions performed on behalf of the victim user. The vulnerability requires user interaction (viewing the notes) and privileges at the Agent level to exploit. There is no vendor advisory or patch information available at this time.

The vulnerability enables attackers with Agent-level access to persistently inject malicious scripts into ticket notes. These scripts execute in the context of any user viewing the notes, including high-privilege Superadmin users. This can result in session hijacking or unauthorized actions performed with the victim's privileges. The impact is limited by the requirement for attacker authentication and user interaction but poses a risk to the confidentiality and integrity of user sessions and actions within the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Agent-level privileges to trusted users only and consider monitoring or limiting the use of the Notes field. Avoid viewing ticket notes from untrusted sources. Implement web application firewall (WAF) rules to detect and block common XSS payloads if possible.