RT (Request Tracker) versions prior to 5.0.11 and 6.0.4 have a vulnerability where automatic link creation for URLs in HTML ticket content does not properly HTML-escape the URLs. This allows an attacker who can add HTML content to a ticket, including unauthenticated senders of HTML email to certain queues, to inject scripts that execute when the ticket history is viewed. The script runs with the privileges of the viewing user, potentially allowing unauthorized actions within RT.