Is there a patch available for EUVD-2026-31188?

Yes, a patch is available for EUVD-2026-31188. Update the affected software to the latest version immediately.

Open ISES Tickets EUVD-2026-31188

Q: What is the CVSS score of EUVD-2026-31188?

EUVD-2026-31188 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35015 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 VulnCheck

GHSA-3g8r-5j29-m2x7

PHP XSS Tickets

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 20, 2026 - 20:37 vuln.today

Analysis Generated

May 20, 2026 - 20:37 vuln.today

CVSS changed

May 20, 2026 - 20:22 NVD

4.6 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the the_ticket parameter that executes in the victim's browser when the URL is visited.

AnalysisAI

Reflected XSS in Open ISES Tickets before 3.44.2 enables injection of arbitrary JavaScript via the unsanitized the_ticket GET parameter in do_unit_mail.php, which is written directly into a JavaScript variable assignment without output encoding. An attacker who can deliver a crafted URL to a user of the application can execute arbitrary JavaScript in that user's browser session, enabling session hijacking, credential theft, or UI redirection. No active exploitation is confirmed (not in CISA KEV), and no public POC is identified at time of analysis, though a patch commit and vendor release are publicly available, raising the exposure window.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing application (CPE: cpe:2.3:a:openises:tickets:*:*:*:*:*:*:*:*). The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS): user-supplied GET parameter data is interpolated directly into a JavaScript variable assignment in do_unit_mail.php without HTML or JavaScript encoding. This pattern - assigning untrusted GET data into a JS variable like var ticket = 'USERINPUT'; - allows an attacker to break out of the string context with a payload such as ';alert(1);// and execute arbitrary JavaScript. The v3.44.2 release notes confirm this was one of 69 XSS vulnerabilities fixed across 22 files, indicating systemic lack of output encoding across the codebase rather than an isolated oversight.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately. This is a critical security release confirmed by the vendor that patches 88 vulnerabilities, including the 69 XSS issues of which CVE-2026-35015 is one. The patch is available at https://github.com/openises/tickets/releases/tag/v3.44.2. For Docker deployments, run docker compose pull && docker compose up -d. For traditional installs, download the v3.44.2 zip, extract over the existing installation, and run the installer in Upgrade mode. Given that the same release also fixes 19 SQL injection vulnerabilities and removes hardcoded credentials, upgrading is strongly prioritized over any workaround. If immediate upgrade is not possible, consider restricting access to do_unit_mail.php via web server configuration (e.g., IP allowlist or authentication gateway at the reverse proxy layer) as a temporary compensating control - note this may disrupt legitimate mail-related ticket workflows. Do not rely on WAF-based XSS filtering alone given the breadth of unpatched issues in older versions.