Is there a patch available for CVE-2026-48228?

Yes, a patch is available for CVE-2026-48228. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48228

Q: What is the CVSS score of CVE-2026-48228?

CVE-2026-48228 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31310 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-jhvr-q5p3-895g

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:37 vuln.today

Analysis Generated

May 21, 2026 - 18:37 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_w.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id and ticket_id GET parameters directly into an HTML form action URL. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) allows attackers to inject arbitrary JavaScript through unsanitized id and ticket_id GET parameters in patient_w.php, which are written directly into an HTML form action URL without output encoding. Successful exploitation requires the victim to actively click a crafted link, after which the payload executes in the victim's browser under the application's origin, enabling session hijacking or unauthorized actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the scale of the v3.44.2 release - patching 69 XSS and 19 SQL injection issues simultaneously - suggests the codebase has historically received minimal security review.

Technical ContextAI

Open ISES Tickets is a PHP-based patient ticketing system (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The vulnerable code in patient_w.php accepts user-supplied values via the id and ticket_id HTTP GET parameters and interpolates them directly into an HTML form action attribute without sanitization or output encoding. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) defect: the application trusts attacker-controlled input as safe HTML content. Because form action attributes accept URI values, a javascript: scheme or event-handler injection can force script execution when the page renders. The scope impact is confined to the subsequent system (browser) rather than the server itself, consistent with the CVSS 4.0 SC:L/SI:L rating. The v3.44.2 release notes confirm the fix was applied across 22 files, indicating this pattern was pervasive throughout the codebase.

RemediationAI

The primary fix is upgrading to Open ISES Tickets v3.44.2, available at https://github.com/openises/tickets/releases/tag/v3.44.2. Notably, this release addresses 88 total vulnerabilities including 69 XSS issues, 19 SQL injection flaws, and hardcoded credentials - upgrade should be treated as urgent regardless of XSS exposure alone. For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional installs, download the release zip, extract over the existing installation, and run the installer in Upgrade mode; existing passwords are preserved. The fix commit is ecfeb406 (https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). If immediate patching is not possible, a compensating control is to deploy a web application firewall rule blocking requests to patient_w.php that contain angle brackets, javascript:, or on* event patterns in the id or ticket_id parameters - this reduces exposure but does not eliminate it and may cause false positives on legitimate numeric IDs. Given the SQL injection vulnerabilities in the same release, restricting external network access to the application entirely until patched is strongly advisable for internet-facing deployments.