Is there a patch available for CVE-2026-35007?

Yes, a patch is available for CVE-2026-35007. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-35007

Q: What is the CVSS score of CVE-2026-35007?

CVE-2026-35007 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31175 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 VulnCheck

GHSA-m2f3-vcp9-x8xr

PHP XSS Tickets

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:34 vuln.today

Analysis Generated

May 20, 2026 - 20:34 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.6 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single_unit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a malicious URL containing a JavaScript payload in the id parameter that executes in the victim's browser when the URL is visited.

AnalysisAI

Reflected XSS in Open ISES Tickets before version 3.44.2 allows attackers to inject arbitrary JavaScript into a victim's browser session via the unsanitized 'id' GET parameter in single_unit.php. The injected value is written directly into an HTML attribute without escaping, enabling session hijacking, credential theft, or malicious redirects when a victim visits an attacker-crafted URL. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 security release - indicating systemic input validation failures across the application. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing and asset management application (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*). The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS, where the PHP script single_unit.php reads the 'id' GET parameter and interpolates it directly into an HTML attribute in the server-side rendered response without HTML-encoding or sanitization. Because the injection point is an HTML attribute context, an attacker can break out of the attribute using a quote character and inject event handlers (e.g., onerror, onmouseover) or a javascript: URI. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms the attack is network-reachable, low complexity, requires no attack prerequisites on the infrastructure, requires no privileges on the vulnerable system per the vector, but does require active user interaction - consistent with the link-delivery model of reflected XSS.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately - this is the vendor-confirmed patched version (https://github.com/openises/tickets/releases/tag/v3.44.2). The specific fix commit is ecfeb406a016766cae81c749e14b5145a9f2dbff (https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional deployments, download the zip archive, extract over the existing install, and run the installer in Upgrade mode. Note that v3.44.2 patches 88 total vulnerabilities including 19 SQL injection flaws - this makes upgrading critical beyond just the XSS issue. If an immediate upgrade is not possible, a compensating control is to place a WAF rule blocking requests to single_unit.php where the 'id' parameter contains quote characters, angle brackets, or JavaScript URI schemes; note this is a partial mitigation only and will not address the co-located SQL injection vulnerabilities. Critically, the release notes reveal that Docker default credentials are admin/admin - change these immediately post-deployment regardless of version.