Best Practical RT (Request Tracker) versions 4.4 through 4.4.7 and 5.0 through 5.0.7 are vulnerable to a cross-site scripting (XSS) issue via injection of crafted parameters in a search URL. This vulnerability allows an attacker to execute arbitrary scripts in the context of the affected application without requiring user interaction or privileges.