Is there a patch available for EUVD-2026-31180?

Yes, a patch is available for EUVD-2026-31180. Update the affected software to the latest version immediately.

Open ISES Tickets EUVD-2026-31180

Q: What is the CVSS score of EUVD-2026-31180?

EUVD-2026-31180 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35009 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 VulnCheck

GHSA-qvvw-c5vm-j9c8

PHP XSS Tickets

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:35 vuln.today

Analysis Generated

May 20, 2026 - 20:35 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.6 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_note.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a hidden input field VALUE attribute. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim's browser when the URL is visited.

AnalysisAI

Reflected XSS in Open ISES Tickets before 3.44.2 allows injection of arbitrary JavaScript via the unsanitized ticket_id GET parameter in add_note.php, with payload execution occurring in the browser of any authenticated user who visits a crafted URL. The CVSS 4.0 score of 5.1 (Medium) reflects the mandatory user interaction requirement and impact scope limited to the browser context, with no server-side confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis; the vendor released v3.44.2 as a critical security update that addresses this issue alongside 87 additional vulnerabilities.

Technical ContextAI

The vulnerability (CWE-79, Improper Neutralization of Input During Web Page Generation) exists in the PHP-based Open ISES Tickets application (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*). The add_note.php script reflects the ticket_id GET parameter value directly into a hidden HTML input field's VALUE attribute without output encoding or sanitization, allowing an attacker to break out of the attribute context and inject executable JavaScript. This is a classic reflected (Type I) XSS pattern. The vulnerability is not isolated: the v3.44.2 release notes document 69 XSS vulnerabilities patched across 22 files and 19 SQL injection issues across 11 files in the same release, indicating systemic failure of input handling throughout the codebase rather than a single oversight.

RemediationAI

The primary fix is upgrading to Open ISES Tickets v3.44.2 - vendor-released patch confirmed at https://github.com/openises/tickets/releases/tag/v3.44.2, with the specific patch commit at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. Given that v3.44.2 also patches 19 SQL injection vulnerabilities, removes hardcoded secrets, and fixes SSL certificate validation, upgrade is strongly warranted independent of this specific CVE. For Docker deployments, execute docker compose pull && docker compose up -d; for traditional installations, download the v3.44.2 zip, extract over the existing install, and run the installer in Upgrade mode - the release notes confirm upgrade compatibility from any prior version. If immediate upgrade is not feasible, restrict access to add_note.php via web server access controls such as IP allowlisting to internal authenticated networks, reducing social engineering attack surface; this is a compensating control only and does not remediate the underlying flaw. Note that upgrading to v3.44.2 changes SSL certificate validation to verify-by-default, which may require updating configurations for any internal services with self-signed certificates.