Executive brief
Open ISES Tickets is an open-source ticket management system used for tracking support requests and organizational tasks. A security flaw in the system allows an attacker to trick a logged-in user into clicking a malicious link, which then executes unauthorized code in their web browser. This could allow an attacker to steal session information, perform actions on behalf of the user, or access sensitive ticket data.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets prior to version 3.44.2. The issue is located in 'single.php' where the 'ticket_id' GET parameter is improperly sanitized before being rendered into an HTML attribute. An authenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes within the context of their browser session. The vendor has addressed this in version 3.44.2 by implementing input validation using 'intval()' and output encoding via 'htmlspecialchars()'.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to GitHub repository.
- 2026-04-02: advisory: Release v3.44.2 published.
- 2026-05-20: disclosed: CVE-2026-35008 published.