Is there a patch available for CVE-2026-48219?

Yes, a patch is available for CVE-2026-48219. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48219

Q: What is the CVSS score of CVE-2026-48219?

CVE-2026-48219 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31298 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-779w-5rjw-wphj

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:42 vuln.today

Analysis Generated

May 21, 2026 - 18:42 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics202.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 enables JavaScript injection via the frm_add_str POST parameter in ics202.php, where the unsanitized value is written directly into an HTML form hidden input value attribute. The CVSS 4.0 vector (PR:N/UI:A) indicates no attacker privilege is required, but victim interaction is mandatory - meaning an attacker must deceive a user into submitting a crafted POST request to trigger execution. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 release alongside 19 SQL injection flaws and 5 hardcoded secrets, signaling a systemic insecurity posture in the codebase prior to this release. No public exploit identified at time of analysis; no CISA KEV listing.

Technical ContextAI

Open ISES Tickets is a PHP-based incident/service ticketing application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant: user-supplied input from the frm_add_str POST parameter is interpolated directly into an HTML form hidden input value attribute without HTML-encoding or sanitization. Because the value sits inside an HTML attribute context, an attacker can break out of the attribute with a quote character and inject event handlers or script tags. POST-based reflected XSS is distinct from GET-based: the payload cannot be delivered via a crafted URL alone - it requires the victim's browser to submit a POST request, typically achieved through an attacker-controlled page with an auto-submitting HTML form. The PHP-specific tagging and the release notes' mention of compatibility issues through PHP 8.4 confirm this is a legacy PHP application with broad version exposure.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately; this is vendor-confirmed via the GitHub release tag (https://github.com/openises/tickets/releases/tag/v3.44.2) and patch commit ecfeb406a016766cae81c749e14b5145a9f2dbff. The vendor labels this a 'Critical Security Update' and urges all users to upgrade, noting it resolves 88 vulnerabilities including 69 XSS and 19 SQL injection flaws - making this upgrade high-priority even for deployments where the specific XSS exposure is low. For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional deployments, download the v3.44.2 zip, extract over the existing install, and run the installer in Upgrade mode. If immediate patching is not feasible, as a compensating control restrict access to ics202.php at the web server or WAF layer to trusted networks only, and ensure Content-Security-Policy headers are configured to block inline script execution - this limits XSS impact but does not eliminate the root vulnerability. Additional context from VulnCheck advisory: https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ics202-php-frm-add-str-parameter.