Executive brief
Open ISES Tickets, a help desk and ticketing system, contains a security flaw that could allow an attacker to execute malicious scripts in a user's browser. By tricking a logged-in user into clicking a specially crafted link, an attacker could potentially steal session information or perform unauthorized actions on behalf of that user. This issue affects versions prior to 3.44.2, and organizations should update to the latest version to protect their data and operations.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The flaw is located in the 'add_facnote.php' component, where the 'ticket_id' GET parameter is processed without sufficient sanitization before being rendered into the VALUE attribute of a hidden HTML input field. An authenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes within the context of their browser session, potentially allowing for session hijacking or unauthorized data access. The vulnerability was addressed in version 3.44.2 by implementing proper input validation using functions like 'htmlspecialchars()' and 'intval()'.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to GitHub repository
- 2026-04-02: advisory: Release v3.44.2 published
- 2026-05-20: disclosed: CVE-2026-35012 published