Is there a patch available for CVE-2026-48220?

Yes, a patch is available for CVE-2026-48220. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48220

Q: What is the CVSS score of CVE-2026-48220?

CVE-2026-48220 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31303 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-f3p8-2q87-pvj5

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:42 vuln.today

Analysis Generated

May 21, 2026 - 18:42 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) allows injection of arbitrary JavaScript through the frm_add_str POST parameter in ics205.php, which is rendered unsanitized inside an HTML form hidden input value attribute. The attacker must induce an authenticated victim to submit a crafted request (UI:A), limiting opportunistic exploitation but enabling session hijacking, credential theft, or further browser-based attacks against logged-in users. This CVE is one of 69 XSS vulnerabilities patched in v3.44.2, which also addressed 19 SQL injection issues and hardcoded credentials - indicating systemic input-handling deficiencies across the PHP codebase. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Open ISES Tickets is a PHP-based incident/service ticketing application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS rooted in the failure to sanitize or encode the frm_add_str value before embedding it directly into an HTML form hidden input attribute in ics205.php. In PHP applications, this class of flaw typically arises when POST/GET parameters are echoed into HTML output via direct string interpolation without htmlspecialchars() or equivalent encoding. Because the injection point is a hidden input value attribute, an attacker can break out of the attribute context using a double-quote and inject event handlers or script tags. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) reflects a network-reachable endpoint with no special attack-side preconditions beyond victim interaction. The broader v3.44.2 release context - fixing hardcoded secrets, SSL certificate bypass, and 0777 file permissions - suggests this codebase historically lacked systematic security controls.

RemediationAI

Upgrade immediately to Open ISES Tickets v3.44.2, which is confirmed by the vendor as a critical security release patching 88 vulnerabilities including this reflected XSS and 19 SQL injection flaws. For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional installs, download the v3.44.2 zip, extract over the existing installation, and run the installer in Upgrade mode - existing password hashes are automatically migrated. Upgrade is strongly recommended regardless of this specific CVE because the same release also removes hardcoded API keys and database passwords, fixes SSL certificate validation bypass, and corrects overly permissive 0777 file permissions: deferring the upgrade leaves all of those issues open. If an immediate upgrade is not possible, restrict access to ics205.php via web server ACLs (e.g., limit by source IP or require HTTP Basic Auth at the server layer for that path); this trades off availability of the feature for users but eliminates the reflected XSS attack surface. Do not rely on WAF rules alone as the primary mitigation, since POST body filtering for XSS is bypassable via encoding variations.