Executive brief
Open ISES Tickets is an open-source ticketing and incident management system. A security flaw in the way the application handles ticket identifiers allows an attacker to execute malicious scripts in the web browser of a logged-in user. If a user clicks a specially crafted link, the attacker could potentially steal session information or perform unauthorized actions on behalf of the user.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The flaw is located in 'routes_nm.php' where the 'ticket_id' GET parameter is reflected into the VALUE attribute of a hidden HTML input field without proper sanitization or encoding. An authenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the payload executes within the context of their browser session. The vendor has addressed this in version 3.44.2 by implementing 'intval()' and 'htmlspecialchars()' to sanitize the affected input.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to GitHub repository.
- 2026-04-02: advisory: Version 3.44.2 released.
- 2026-05-20: disclosed: CVE-2026-35014 published.