When used edit ticket button on the ticket view page in the message field contains XSS and script code

[komal-sh-27]

Description
When used edit ticket button on the ticket view page in the message field contains XSS code

How to reproduce
Step 1: Go to the admin panel and click on tickets

Step 2: Now click on the edit ticket option and use these code scripts:

1. <script type = "text/javascript">
function fun() {
alert ("This is an alert dialog box");
}
</script>

After updating the ticket here does not show script code like text:

2. <b onmouseover=alert('Uvdesk!')>click me!

After update:

Hover or click on this shows an alert box:

3. ">

After Update shows an alert box:

Possible Solution

If we using any script code so should be shown all content like this: