EUVD-2026-31299
GHSA-6v86-xjjm-2m4x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_name and frm_id POST parameters directly into rendered HTML content and inline JavaScript. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
AnalysisAI
Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) exposes the icons/buttons/landb.php endpoint to arbitrary JavaScript injection via unsanitized frm_name and frm_id POST parameters, which are rendered directly into both HTML content and inline JavaScript without encoding or sanitization. An attacker who can socially engineer an authenticated user into triggering a crafted POST request can execute arbitrary JavaScript within that user's browser session, enabling session hijacking, credential theft, or malicious UI manipulation. No public exploit has been identified at time of analysis; a vendor-released patch (v3.44.2) is available and all users are urged to upgrade immediately per the vendor's own release advisory.
Technical ContextAI
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the reflected variant where attacker-controlled input is echoed back in a single HTTP response without sanitization. The affected application is Open ISES Tickets, a PHP-based IT service management/ticketing platform (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The sink is the PHP file icons/buttons/landb.php, which accepts frm_name and frm_id via HTTP POST and inlines their values directly into rendered HTML and JavaScript contexts - a dual-context injection that amplifies exploitability since standard HTML encoding alone may be insufficient for the JavaScript context. The v3.44.2 release notes confirm this is one of 69 XSS vulnerabilities fixed across 22 files in a single release, indicating systemic lack of output encoding throughout the codebase rather than an isolated defect.
RemediationAI
Upgrade to Open ISES Tickets v3.44.2 immediately; the vendor labels this a 'Critical Security Update' and the release resolves 88 total vulnerabilities across XSS, SQL injection, hardcoded secrets, and SSL validation categories. The specific patch commit addressing this vulnerability is available at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff, and the tagged release is at https://github.com/openises/tickets/releases/tag/v3.44.2. For Docker deployments, upgrade with 'docker compose pull && docker compose up -d'; for traditional installs, download the zip and run the installer in Upgrade mode - the vendor states all existing passwords remain functional after upgrade. If immediate patching is not possible, restrict access to the icons/buttons/landb.php endpoint at the web server or WAF layer, blocking external POST requests to that path; note this may break legitimate UI functionality relying on that endpoint. Deploying a WAF rule to strip or encode script-bearing POST parameter values is an additional interim control, though it does not eliminate the root cause.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today