EUVD-2026-31183
GHSA-8whj-r8vv-vfhh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_call GET parameter directly into page output. Attackers can craft a malicious URL containing a JavaScript payload in the frm_call parameter that executes in the victim's browser when the URL is visited.
AnalysisAI
Reflected cross-site scripting in Open ISES Tickets before v3.44.2 allows attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a payload in the frm_call GET parameter of opena.php, which is reflected directly into page output without sanitization. The CVSS 4.0 vector scores this at 5.1 (Medium), with impact limited to the subsequent browser context (SC:L/SI:L) rather than the server itself. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV - however, the v3.44.2 release patched 88 total vulnerabilities including 19 SQL injection flaws, indicating systemic security debt warranting urgent upgrade regardless of this CVE's moderate score.
Technical ContextAI
This is a classic reflected (non-persistent) XSS flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected application is Open ISES Tickets (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*), a PHP-based ticketing system. The root cause is the frm_call GET parameter in opena.php being interpolated directly into HTML page output without HTML entity encoding or context-aware output escaping - a foundational PHP output handling failure. The GitHub commit ecfeb406a016766cae81c749e14b5145a9f2dbff patches this specific flaw. The scale of the v3.44.2 security release - 69 XSS vulnerabilities fixed across 22 files and 19 SQL injection vulnerabilities across 11 files - indicates the absence of a centralized output encoding layer or parameterized query standard throughout the codebase, rather than an isolated oversight in a single file.
RemediationAI
Upgrade to Open ISES Tickets v3.44.2 immediately - this is the vendor-confirmed patched version and is described as a Critical Security Update. For Docker deployments, run docker compose pull && docker compose up -d. For traditional installations, download the v3.44.2 archive from https://github.com/openises/tickets/releases/tag/v3.44.2, extract it over the existing installation, and run the built-in installer in Upgrade mode; the release is backward-compatible with legacy password hash formats so no credential resets are required. If immediate patching is not feasible, restrict access to opena.php via web server IP allowlisting to limit exposure to trusted networks - note this may impact ticket submission workflows depending on how the file is used. A WAF rule rejecting script injection patterns in the frm_call GET parameter can serve as a temporary compensating control, though WAF bypass is a known risk and this is not a substitute for patching. Given that 19 SQL injection vulnerabilities were simultaneously patched in v3.44.2, delaying the upgrade poses risk well beyond this single CVE.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today