CVE-2026-48225: Open ISES Tickets reflected XSS in landb.php

CVE-2026-48225 · Severity: medium · CVSS 5.4 · Published 2026-05-21

Open ISES Tickets is an open-source ticketing and incident management system. A security flaw in the software allows an attacker to inject malicious scripts into the application. If a user interacts with a specially crafted link or form, the attacker could steal login credentials, hijack user sessions, or perform unauthorized actions on behalf of the victim.

Technologies: Open ISES Tickets. Vendors: Open ISES.

Quick answers

Is CVE-2026-48225 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48225 being exploited in the wild.
How severe is CVE-2026-48225?
Medium severity, with a CVSS score of 5.4, published 21 May 2026.
Which products and versions are affected?
Open ISES Tickets < 3.44.2.
Is there a fix for CVE-2026-48225?
A patch was published on 2026-04-01: Fix committed to GitHub repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48225 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48225?
Check whether you run Open ISES Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Open ISES Tickets versions prior to 3.44.2. The flaw is located in landb.php, where the '_type' POST parameter is processed without sufficient sanitization before being rendered into the 'value' attribute of a hidden HTML input field. An authenticated attacker can exploit this by crafting a malicious request containing a JavaScript payload. When a victim's browser renders the response, the payload executes in the context of the victim's session. This can lead to session hijacking or unauthorized data access. The issue was addressed in version 3.44.2 by implementing proper output encoding using htmlspecialchars().

Affected products

  • Open ISES Tickets < 3.44.2

Timeline

  • 2026-04-01: patched: Fix committed to GitHub repository.
  • 2026-04-02: advisory: Version 3.44.2 released.
  • 2026-05-21: disclosed: CVE-2026-48225 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.