An issue exists in Znuny 7.0.1 up to and including 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.