Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Open ISES Tickets lets logged‑in users run JavaScript

CVE-2026-48230 · published 5 months ago
Summary

The Open ISES Tickets system (versions before 3.44.2) inserts data from several form fields directly into the page without cleaning it. A user who is already logged in can send specially crafted data that places malicious JavaScript into the page, which then runs in the browser of anyone who views the response. Update to version 3.44.2 or later, or apply a patch that properly sanitizes those input fields.

Original advisory text
Open ISES Tickets < 3.44.2 Reflected XSS via ticketsmdb_import.php Multiple POST Parameters
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix, ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix) directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published21 May 2026
Updated29 Oct 2026
First seen21 May 2026
Sources
CVE-2026-48230 · NVD
CVE-2026-48230 · OSV
Track software like this
Free during beta