EUVD-2026-31182
GHSA-p7vj-52m5-2hp4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim's browser when the URL is visited.
AnalysisAI
Reflected XSS in Open ISES Tickets before 3.44.2 enables JavaScript injection via the ticket_id GET parameter in patient_JF.php, where the unsanitized value is written directly into a JavaScript variable assignment in the server response. The CVSS 4.0 vector (PR:N, UI:A) indicates no authentication is required from the attacker's side, though the CVE description contradicts this by specifying 'authenticated attackers' - this conflict should be verified with the vendor. Exploitation requires the victim to actively visit a crafted URL, limiting mass exploitation, but the broader v3.44.2 release context - which patches 88 total vulnerabilities including 19 SQL injection flaws - signals systemic input validation failures across the codebase. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Open ISES Tickets is a PHP-based healthcare ticketing application (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*). The vulnerable endpoint, patient_JF.php, accepts a ticket_id value via HTTP GET and interpolates it unsanitized into a server-side JavaScript variable assignment in the HTML response - a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) pattern. This sink-type placement means standard HTML-entity encoding alone would not prevent exploitation if the value lands inside a script block; proper JavaScript context escaping (e.g., JSON encoding or allowlist validation) is required. The v3.44.2 release notes confirm this was not an isolated oversight: 69 XSS vulnerabilities were patched across 22 files in the same release, alongside 19 SQL injection issues, indicating pervasive lack of output encoding and parameterized queries throughout the application. The patch is available at the referenced GitHub commit (ecfeb406a016766cae81c749e14b5145a9f2dbff).
RemediationAI
Upgrade to Open ISES Tickets v3.44.2 immediately; the vendor labels this release a 'Critical Security Update' and states all users should upgrade. The specific fix for this CVE is in commit ecfeb406a016766cae81c749e14b5145a9f2dbff (https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional installations, download the v3.44.2 zip, extract over the existing install, and run the installer in Upgrade mode. If immediate patching is not feasible, a compensating control is to block external access to patient_JF.php via web server configuration (e.g., deny access to this endpoint from untrusted networks), though this may break legitimate functionality for remote users. Additionally, given that the same release patches 19 SQL injection vulnerabilities, treat the entire pre-3.44.2 codebase as critically exposed and prioritize upgrade over partial mitigation. Note that the v3.44.2 release also removes hardcoded secrets and fixes SSL certificate validation - reverting to default Docker credentials (admin/admin) after upgrade is a separate risk that must be addressed post-upgrade.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today