Is there a patch available for CVE-2026-48223?

Yes, a patch is available for CVE-2026-48223. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48223

Q: What is the CVSS score of CVE-2026-48223?

CVE-2026-48223 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31306 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-96p4-6rgc-hp28

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:43 vuln.today

Analysis Generated

May 21, 2026 - 18:43 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213rr.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets before 3.44.2 allows a malicious actor to inject arbitrary JavaScript into a victim's browser session via the unsanitized frm_add_str POST parameter in ics213rr.php, where the value is written directly into an HTML form hidden input attribute without escaping. The CVSS 4.0 vector scores this at 5.1 with scope change to subsequent systems (SC:L/SI:L), meaning successful exploitation affects data beyond the immediately vulnerable component. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch (v3.44.2) is confirmed available and also resolves 87 additional vulnerabilities including SQL injection, hardcoded credentials, and SSL validation failures.

Technical ContextAI

Open ISES Tickets is a PHP-based emergency management ticketing application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The vulnerable file, ics213rr.php, accepts the frm_add_str parameter via HTTP POST and interpolates it directly into an HTML form's hidden input value attribute without HTML-entity encoding or other sanitization. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS: server-side code trusts attacker-controlled input and mirrors it back to the browser in executable context. Because the parameter is delivered via POST rather than GET, exploitation requires the victim to submit a crafted form - typically achieved by hosting a malicious auto-submitting HTML page or leveraging CSRF-style delivery. The v3.44.2 release notes confirm the patch commit (ecfeb406a016766cae81c749e14b5145a9f2dbff) and reveal 69 XSS instances were fixed across 22 files, indicating this vulnerability was part of a systemic pattern of unsanitized output throughout the application.

RemediationAI

The primary fix is to upgrade to Open ISES Tickets v3.44.2, which is confirmed as a vendor-released patch via GitHub release tag v3.44.2 (https://github.com/openises/tickets/releases/tag/v3.44.2) and the associated patch commit ecfeb406a016766cae81c749e14b5145a9f2dbff (https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). For traditional installs, download the zip, extract over the existing installation, and run the installer in Upgrade mode; Docker deployments should run 'docker compose pull && docker compose up -d'. Upgrade is strongly recommended beyond just this CVE: v3.44.2 simultaneously addresses 19 SQL injection vulnerabilities and removes hardcoded credentials, making deferral significantly more risky than the single-CVE CVSS score implies. If immediate upgrade is not possible, restrict access to ics213rr.php via web server configuration (e.g., require authenticated network access or IP allowlisting) to reduce exposure, noting this is a compensating control only and does not address the other 87 vulnerabilities patched in this release. The VulnCheck advisory at https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ics213rr-php-frm-add-str-parameter provides additional remediation context.