CVE-2026-48218

MEDIUM 5.4

Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

9th

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_name and frm_id POST parameters directly into rendered HTML content and inline JavaScript. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

CWE	CWE-79
Vendor	open ises
Product	tickets
Published	May 21, 2026
Last Updated	May 23, 2026

Stay Ahead of the Next One

Get instant alerts for open ises tickets

Be the first to know when new medium vulnerabilities affecting open ises tickets are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Open ISES / Tickets

0 < 3.44.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openises/tickets/releases/tag/v3.44.2 github.com: https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff vulncheck.com: https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-icons-buttons-landb-php-frm-name-and-frm-id-parameters