Executive brief
Open ISES Tickets, an open-source incident management and ticketing system, contains a security flaw in its module deletion component. An authenticated attacker can trick a user into clicking a malicious link or submitting a crafted form, allowing the attacker to run unauthorized scripts in the user's web browser. This could lead to the theft of session information or the performance of unauthorized actions on behalf of the victim.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets before version 3.44.2 within the 'delete_module.php' file. The application fails to properly sanitize the 'module_choice', 'flag', and 'confirmation' POST parameters before rendering them back into HTML content and form action attributes. An authenticated attacker can exploit this by crafting a malicious request that, when processed by a victim's browser, executes arbitrary JavaScript in the context of the victim's session. This vulnerability was addressed in version 3.44.2 by implementing proper input neutralization using htmlspecialchars() and other sanitization strategies.
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to repository
- 2026-04-02: advisory: Version 3.44.2 released
- 2026-05-21: disclosed: CVE published to NVD