CVE-2021-42085

Zammad (web-based help desk) before version 4.1.1 has a stored XSS via the custom Avatar feature. The issue affects versions prior to 4.1.1; exploitation would involve injecting JavaScript through the avatar. Remediation indicated by sources is upgrade to 4.1.1 or later (exact patched version per...