Is there a patch available for CVE-2026-35012?

Yes, a patch is available for CVE-2026-35012. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-35012

Q: What is the CVSS score of CVE-2026-35012?

CVE-2026-35012 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31186 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 VulnCheck

GHSA-5xfh-m3mm-j8mj

PHP XSS Tickets

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:36 vuln.today

Analysis Generated

May 20, 2026 - 20:36 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.6 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a hidden input field VALUE attribute. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim's browser when the URL is visited.

AnalysisAI

Reflected XSS in Open ISES Tickets before version 3.44.2 enables JavaScript injection via the ticket_id GET parameter in add_facnote.php, which is written unsanitized into a hidden HTML input field's VALUE attribute. An attacker can craft a URL containing a JavaScript payload and trick a user into visiting it, causing script execution in the victim's browser session within the application's origin. No public exploit has been identified at time of analysis, and a vendor-released patch is confirmed at v3.44.2. Notably, this CVE is one of at least 69 XSS vulnerabilities addressed in the same release, indicating systemic input sanitization failures across the codebase.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing application (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant where user-controlled input from an HTTP GET parameter (ticket_id) is rendered directly into an HTML attribute without encoding or sanitization. Injecting a payload such as " onmouseover="alert(1) into a VALUE attribute is a classic HTML injection vector. The release notes for v3.44.2 reveal that the codebase contained 69 XSS vulnerabilities across 22 files, 19 SQL injection vulnerabilities across 11 files, and 5 hardcoded secrets - suggesting a legacy PHP codebase with no systematic output encoding or parameterized query discipline. The affected PHP version range spans 7.0 through 8.4+, confirming broad deployment surface.

RemediationAI

The primary fix is to upgrade to Open ISES Tickets v3.44.2, the confirmed vendor-patched release available at https://github.com/openises/tickets/releases/tag/v3.44.2. The specific patch commit addressing this vulnerability is ecfeb406a016766cae81c749e14b5145a9f2dbff (https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). For Docker deployments, upgrade via 'docker compose pull && docker compose up -d'; for traditional installs, download the zip, extract over the existing install, and run the installer in Upgrade mode. Given that v3.44.2 simultaneously addresses 69 XSS vulnerabilities, 19 SQL injection vulnerabilities, and 5 hardcoded secrets, upgrading is strongly prioritized over piecemeal workarounds - partial mitigations like WAF rules for add_facnote.php alone would leave the broader attack surface exposed. If immediate upgrade is not possible, restricting access to add_facnote.php via web server ACLs to trusted IP ranges reduces exposure, with the trade-off of breaking legitimate functionality for remote users.