Is there a patch available for EUVD-2026-31297?

Yes, a patch is available for EUVD-2026-31297. Update the affected software to the latest version immediately.

Open ISES Tickets EUVD-2026-31297

Q: What is the CVSS score of EUVD-2026-31297?

EUVD-2026-31297 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-48214 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-xcp4-wvj7-mg5q

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:40 vuln.today

Analysis Generated

May 21, 2026 - 18:40 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_nm.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id POST parameter directly into an HTML form input value attribute and an inline JavaScript string literal. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected XSS in Open ISES Tickets before v3.44.2 enables JavaScript injection through the unsanitized ticket_id POST parameter in add_nm.php, which is embedded without encoding into both an HTML form input value attribute and an inline JavaScript string literal - two distinct injection contexts. When a victim renders the malicious response, attacker-controlled script executes in their browser with potential to steal session tokens or perform actions under their identity. No public exploit exists and the vulnerability is not in CISA KEV, but the v3.44.2 release notes reveal 88 co-patched security defects (including 19 SQL injection issues and hardcoded secrets), meaning any unpatched deployment faces compounded, systemic risk far beyond this single CVE.

Technical ContextAI

Open ISES Tickets is a PHP-based helpdesk/ticketing application. The vulnerable file, add_nm.php, accepts a ticket_id value via HTTP POST and interpolates it without output encoding into two distinct HTML rendering contexts: an HTML attribute (value="[input]") and an inline JavaScript string literal (e.g., var x = "[input]"). Dual-context injection typically means both HTML-breaking payloads (e.g., "><script>...</script>) and JavaScript string-breaking payloads (e.g., ";alert(1);//) are viable, broadening exploitability. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the absence of context-sensitive output encoding - htmlspecialchars() for HTML contexts and JSON encoding or explicit escaping for JavaScript string contexts. Affected products are identified by CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:* covering all releases before 3.44.2. The application stack is PHP with MariaDB/MySQL, as confirmed by the v3.44.2 release notes.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately - this is the vendor-confirmed fixed version per the GitHub release at https://github.com/openises/tickets/releases/tag/v3.44.2 and the patch commit at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. The upgrade resolves this CVE along with 68 additional XSS vulnerabilities, 19 SQL injection issues, hardcoded secrets, SSL validation failures, and insecure file permissions across the codebase. For Docker deployments, run docker compose pull && docker compose up -d. For traditional installs, download the v3.44.2 zip, extract it over the existing installation, and run the installer in Upgrade mode - existing password hashes from prior versions are auto-migrated. If immediate patching is not feasible, restrict network access to add_nm.php at the web server or firewall level using an IP allowlist limited to trusted administrators; note this will break ticket management workflows for all other users. Deploying a WAF rule to sanitize or block script-containing values in POST body parameters is an additional compensating control but should not substitute for patching, given the 88 co-patched vulnerabilities including server-side SQL injection issues not mitigated by a client-side WAF alone.