Is there a patch available for CVE-2026-48222?

Yes, a patch is available for CVE-2026-48222. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48222

Q: What is the CVSS score of CVE-2026-48222?

CVE-2026-48222 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31301 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-qv7x-mr4c-wj5h

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:43 vuln.today

Analysis Generated

May 21, 2026 - 18:43 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets before v3.44.2 allows injection of arbitrary JavaScript through the frm_add_str POST parameter in ics213.php, which is rendered unsanitized inside an HTML hidden input value attribute. The CVSS 4.0 vector (PR:N/UI:A) indicates no privileges are required on the attacker side, but victim interaction is mandatory - a user must submit or be tricked into triggering the crafted request. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 critical security release, signaling systemic input sanitization failures across the codebase. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

Open ISES Tickets is a PHP-based incident ticketing and ICS-213 general message form application. The vulnerable component is ics213.php, a PHP script handling ICS-213 form submissions. The frm_add_str POST parameter is passed directly into an HTML form hidden input value attribute without sanitization or encoding, creating a reflected XSS sink. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause class: user-controlled data flows into output HTML without context-aware encoding, enabling script injection in the victim's browser DOM. The CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:* confirms all version lines of the open_ises:tickets application are affected up to the fix. The broader v3.44.2 release notes reveal co-occurring SQL injection flaws, hardcoded credentials, and SSL validation failures - suggesting this XSS exists in a codebase with pervasive unvalidated input patterns.

RemediationAI

The vendor-released patch is v3.44.2, available at https://github.com/openises/tickets/releases/tag/v3.44.2. For traditional deployments, download the zip, extract over the existing installation, and run the installer in Upgrade mode. For Docker deployments, execute 'docker compose pull && docker compose up -d'. The patch commit ecfeb406a016766cae81c749e14b5145a9f2dbff addresses this specific XSS, but upgrading also resolves 19 SQL injection vulnerabilities and removes hardcoded secrets - making prompt upgrade the strongly preferred path over any workaround. If immediate upgrade is not possible, a compensating control would be to restrict access to ics213.php via web server ACL rules (e.g., limiting to trusted IP ranges), accepting the trade-off of reduced functionality for users who legitimately need ICS-213 form access. Additionally, deploying a WAF rule blocking POST requests containing script tags or event handler patterns in frm_add_str can reduce exposure, though WAF rules are bypassable and should not substitute for patching.