Is there a patch available for CVE-2026-35008?

Yes, a patch is available for CVE-2026-35008. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-35008

Q: What is the CVSS score of CVE-2026-35008?

CVE-2026-35008 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31176 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 VulnCheck

GHSA-9483-6rpx-9vj8

PHP XSS Tickets

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:34 vuln.today

Analysis Generated

May 20, 2026 - 20:34 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.6 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into an HTML attribute. Attackers can craft a malicious URL containing a JavaScript payload in the id parameter that executes in the victim's browser when the URL is visited.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows an attacker to inject arbitrary JavaScript via the ticket_id GET parameter in single.php, which is rendered unsanitized into an HTML attribute and executed in a victim's browser upon visiting a crafted URL. This vulnerability is one of 69 XSS issues patched in the v3.44.2 release, which also addressed 19 SQL injection flaws and hardcoded credentials - signaling systemic input handling deficiencies across the application. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 5.1 and mandatory user interaction (UI:A) limit automated exploitation.

Technical ContextAI

Open ISES Tickets is a PHP-based helpdesk/ticketing application (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the reflected variant, where user-supplied input from the ticket_id GET parameter is written directly into an HTML attribute in single.php without encoding or sanitization. The payload is not stored server-side; it exists only in the crafted URL and is reflected back to the browser during page rendering, executing in the victim's origin context. The broader v3.44.2 release notes confirm this is not an isolated defect but one of 69 XSS issues across 22 files, suggesting a pattern of missing output encoding throughout the application's template layer.

RemediationAI

Upgrade Open ISES Tickets to version 3.44.2 immediately. The vendor-released patch is available at https://github.com/openises/tickets/releases/tag/v3.44.2; the specific security fix commit is ecfeb406a016766cae81c749e14b5145a9f2dbff. For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional installations, download the v3.44.2 zip, extract over the existing install, and run the installer in Upgrade mode. If immediate upgrade is not possible, a compensating control would be to restrict access to single.php via web server configuration (e.g., IP allowlist or authentication layer at the reverse proxy) - this prevents unauthenticated parties from reaching the vulnerable endpoint but disrupts intended public ticket access functionality. Given the v3.44.2 release also patches 19 SQL injection vulnerabilities, delaying the upgrade carries risk beyond this CVE alone. The VulnCheck advisory is available at https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-single-php-ticket-id-parameter.