Is there a patch available for CVE-2026-35014?

Yes, a patch is available for CVE-2026-35014. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-35014

Q: What is the CVSS score of CVE-2026-35014?

CVE-2026-35014 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31184 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 VulnCheck

GHSA-8pv6-8844-jf93

PHP XSS Tickets

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:36 vuln.today

Analysis Generated

May 20, 2026 - 20:36 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.6 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_nm.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a hidden input field VALUE attribute. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim's browser when the URL is visited.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets before 3.44.2 allows injection of arbitrary JavaScript via the ticket_id GET parameter in routes_nm.php, which is unsanitized and written directly into an HTML hidden input field VALUE attribute. The CVSS 4.0 vector (PR:N) indicates no privileges are required, but the CVE description explicitly characterizes the attacker as authenticated - this discrepancy must be verified with the vendor before determining actual exploitation prerequisites. Active user interaction is required (UI:A), meaning exploitation depends on a victim clicking a crafted URL. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing system (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*). The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) of the reflected subtype: user-supplied input from the ticket_id GET parameter is interpolated without sanitization or encoding directly into a VALUE attribute of an HTML hidden input element in routes_nm.php. This means a payload like ticket_id=1"><script>alert(1)</script> can break out of the attribute context and execute JavaScript in the victim's browser. The flaw is part of a broader pattern in this codebase: the v3.44.2 release simultaneously patched 69 XSS vulnerabilities across 22 files and 19 SQL injection vulnerabilities across 11 files, indicating systemic lack of output encoding and parameterized query practices throughout the application.

RemediationAI

The vendor-released fix is version 3.44.2, available at https://github.com/openises/tickets/releases/tag/v3.44.2, with the specific patch commit at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. For Docker deployments, upgrade by running 'docker compose pull && docker compose up -d'. For traditional deployments, download the v3.44.2 zip, extract it over the existing installation, and run the installer in Upgrade mode. Upgrade is strongly recommended given the simultaneous fix of 69 XSS issues, 19 SQL injection vulnerabilities, and 5 hardcoded secrets - compensating controls for this single CVE would not address the broader attack surface. If immediate upgrade is not possible, a short-term workaround is to deploy a web application firewall rule blocking requests to routes_nm.php that contain HTML/JavaScript metacharacters (quotes, angle brackets, script tags) in the ticket_id parameter, though this may impact legitimate use of the ticket_id parameter and does not address the other 68 unpatched XSS vectors in the pre-3.44.2 codebase.