GHSA-493h-fvcx-6q62: FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/notecreate endpoint stores the note parameter without sanitization in the supportticketnote table, and src/modules/Support/templates/admin/modsupporttickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.managetickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.