Executive brief
Open ISES Tickets, an open-source ticketing and incident management system, contains a security flaw in its database loading component. An attacker with a valid account can send a specially crafted link to another user; if the victim clicks the link, the attacker can execute malicious code in the victim's browser. This could lead to the theft of session information, unauthorized actions performed on behalf of the user, or the modification of data within the application.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2 within the `db_loader.php` component. The application fails to properly sanitize multiple POST parameters, including `ticketshost`, `ticketsdb`, `ticketsuser`, `ticketspassword`, `ticketsprefix`, and `db_schema`, before reflecting them into HTML form input value attributes. An authenticated attacker can exploit this by crafting a malicious request that, when processed by a victim's browser, executes arbitrary JavaScript in the context of the victim's session. This vulnerability was addressed in version 3.44.2 by implementing `htmlspecialchars()` with `ENT_QUOTES` for string values in HTML attributes.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to GitHub repository.
- 2026-04-02: advisory: Release v3.44.2 published.
- 2026-05-21: disclosed: CVE published to NVD.