EUVD-2026-31295
GHSA-mp75-cpr7-ghj7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in circle.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_id POST parameter directly into an HTML form input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
AnalysisAI
Reflected XSS in Open ISES Tickets (versions before 3.44.2) allows network-based attackers to inject arbitrary JavaScript through the frm_id POST parameter in circle.php, requiring victim interaction with a crafted link or form. The vulnerability executes malicious scripts in the victim's browser context with low-scope impact to confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis. VulnCheck reported this as one of 69 XSS vulnerabilities patched in the v3.44.2 security release, which addressed 88 total security issues including SQL injection and hardcoded credentials.
Technical ContextAI
This is a classic reflected (non-persistent) cross-site scripting vulnerability (CWE-79) in a PHP-based ticketing system. The circle.php script accepts user-supplied input via the frm_id POST parameter and reflects it directly into an HTML form input value attribute without sanitization or encoding. Reflected XSS occurs when server-side code includes unvalidated user input in the HTTP response, allowing attackers to inject script tags or event handlers that execute when the victim's browser renders the response. The CVSS 4.0 vector indicates this requires user interaction (UI:A), meaning the victim must click a malicious link, submit a crafted form, or interact with attacker-controlled content. The affected product is Open ISES Tickets, an open-source PHP application for help desk and ticketing workflows, as identified by CPE cpe:2.3:a:open_ises:tickets. The vulnerability exists in all versions prior to 3.44.2, which was released as a critical security update addressing 88 vulnerabilities including 69 XSS flaws across 22 files.
RemediationAI
Upgrade immediately to Open ISES Tickets version 3.44.2, available at https://github.com/openises/tickets/releases/tag/v3.44.2. The release patches this XSS flaw along with 68 other XSS vulnerabilities, 19 SQL injection issues, and hardcoded credentials. For Docker deployments, run 'docker compose pull && docker compose up -d' to pull the patched image. For traditional installations, download the v3.44.2 zip archive, extract it over the existing installation directory, and run the installer in Upgrade mode to apply database schema changes. The specific fix for CVE-2026-48215 is in commit ecfeb406a016766cae81c749e14b5145a9f2dbff at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. If immediate patching is not feasible, implement compensating controls: deploy a web application firewall (WAF) with XSS detection rules to filter malicious payloads in POST parameters; enforce Content-Security-Policy headers that restrict inline script execution (noting this may break existing functionality in the application); and educate users to avoid clicking untrusted links to the ticketing system. These workarounds provide partial mitigation but do not address the underlying input validation failure or the 87 other vulnerabilities patched in 3.44.2, so they should be treated as temporary measures only.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today