Executive brief
Open ISES Tickets, a web-based ticketing and incident management system, contains a security flaw that could allow an attacker to execute malicious scripts in a user's browser. By tricking a logged-in user into clicking a specially crafted link or submitting a malicious form, an attacker could steal session information or perform unauthorized actions on behalf of the user. This issue affects versions prior to 3.44.2, and organizations are encouraged to upgrade to the latest version to protect their operations.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The flaw is located in the ics205.php component, where the 'frm_add_str' POST parameter is processed without sufficient sanitization before being rendered into an HTML hidden input value attribute. An authenticated attacker can exploit this by crafting a malicious request containing a JavaScript payload. If a victim user processes this request, the payload executes within the context of their browser session, potentially leading to session hijacking or unauthorized data access. The vulnerability was addressed in version 3.44.2 by implementing proper output encoding using htmlspecialchars().
Affected products
- Open ISES Tickets before 3.44.2
Timeline
- 2026-04-01: patched: Fix committed to repository
- 2026-04-02: advisory: Release v3.44.2 published
- 2026-05-21: disclosed: CVE-2026-48220 published