Executive brief
Open ISES Tickets is an open-source ticketing and incident management system. A security flaw in the software allows an attacker to send a specially crafted link to a logged-in user that, when clicked, executes malicious code in their web browser. This could allow an attacker to perform actions on behalf of the user or steal sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The vulnerability is located in the 'single_unit.php' component, where the 'id' GET parameter is processed without sufficient sanitization before being rendered into an HTML attribute. An authenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes within the context of their browser session. The vendor has addressed this in version 3.44.2 by implementing proper input validation using the intval() function for numeric identifiers.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to repository
- 2026-04-02: advisory: Release v3.44.2 published
- 2026-05-20: disclosed: CVE published to NVD