Is there a patch available for CVE-2026-35013?

Yes, a patch is available for CVE-2026-35013. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-35013

Q: What is the CVSS score of CVE-2026-35013?

CVE-2026-35013 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31185 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 VulnCheck

GHSA-rv9j-hj4r-57hm

PHP XSS Tickets

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:36 vuln.today

Analysis Generated

May 20, 2026 - 20:36 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.6 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitrary JavaScript by passing unsanitized values through the thelat and thelng GET parameters directly into JavaScript variable assignments. Attackers can craft a malicious URL containing a JavaScript payload in either parameter that executes in the victim's browser when the URL is visited.

AnalysisAI

Reflected XSS in Open ISES Tickets before version 3.44.2 allows an attacker to inject arbitrary JavaScript into a victim's browser session via the thelat and thelng GET parameters in street_view.php, where values are passed unsanitized directly into JavaScript variable assignments. The attack requires user interaction - a victim must visit a crafted URL - and the CVSS 4.0 score of 5.1 reflects limited scope impact (SC:L/SI:L). Notably, this CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 release, which also addressed 19 SQL injection flaws and 5 hardcoded secrets, indicating severe systemic security debt in the codebase. No public exploit identified at time of analysis, and no CISA KEV listing.

Technical ContextAI

Open ISES Tickets is a PHP-based IT ticketing system (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS pattern in street_view.php where user-supplied GET parameters thelat and thelng are concatenated directly into server-side JavaScript variable assignments without sanitization or encoding. Because the values land inside a JavaScript context rather than HTML, standard HTML entity encoding may be insufficient - proper context-aware output encoding for JavaScript string literals is required. The broader v3.44.2 release notes reveal that 69 XSS vulnerabilities were fixed across 22 PHP files in a single batch, and the codebase also contained legacy password hashing (MD5, SHA1, plain text), hardcoded secrets, and SQL injection - suggesting the application has historically not applied consistent output encoding or input validation practices.

RemediationAI

Upgrade immediately to Open ISES Tickets v3.44.2, available at https://github.com/openises/tickets/releases/tag/v3.44.2. The release patches this CVE and 87 additional vulnerabilities including 19 SQL injection flaws, 5 hardcoded secrets, and 4 SSL validation failures - making the upgrade critically urgent regardless of this specific CVE's medium severity score. For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional installs, download the release zip, extract over the existing installation, and run the installer in Upgrade mode. If immediate upgrade is not possible, consider restricting access to street_view.php via web server configuration (e.g., IP allowlisting or authentication gateway in nginx/Apache) as a compensating control - note this disables the street view feature for all users. Do not treat this CVE in isolation: the SQL injection vulnerabilities in the same codebase present a higher-severity risk that makes deferring the upgrade dangerous.