EUVD-2026-31300
GHSA-pqj7-rwf8-6h56
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (module_choice, flag, confirmation) directly into rendered HTML content and form action attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
AnalysisAI
Reflected XSS in Open ISES Tickets before 3.44.2 allows JavaScript injection via unsanitized POST parameters (module_choice, flag, confirmation) in delete_module.php, executing attacker-supplied code in the browser of a victim who interacts with a crafted request. The CVSS 4.0 vector (PR:N/UI:A) indicates the attacker requires no privileges but depends on active victim interaction - consistent with a POST-based reflected XSS delivered via a cross-site auto-submitting form targeting an authenticated session. No public exploit has been identified at time of analysis, and vendor-released patch v3.44.2 is available, a landmark release that simultaneously addressed 88 vulnerabilities including 19 SQL injections and 68 additional XSS issues across the same codebase.
Technical ContextAI
The vulnerability resides in delete_module.php within Open ISES Tickets, a PHP-based helpdesk/ticketing application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the reflected variant: user-supplied values from POST parameters module_choice, flag, and confirmation are echoed back into the rendered HTML response - including into form action attributes - without output encoding or sanitization. Because exploitation is POST-based rather than GET-based, a simple malicious hyperlink is insufficient; an attacker must host an intermediary page that auto-submits a crafted form to the target application, making delivery more complex than typical reflected XSS. The v3.44.2 release notes confirm this was one of 69 XSS vulnerabilities fixed across 22 files, suggesting the absence of a centralized output-encoding layer throughout the application.
RemediationAI
Upgrade to Open ISES Tickets v3.44.2 immediately, available at https://github.com/openises/tickets/releases/tag/v3.44.2. For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional deployments, download the v3.44.2 archive, extract it over the existing installation, and run the bundled installer in Upgrade mode - the release notes confirm it supports upgrades from any prior version with automatic password hash migration. The specific commit addressing this vulnerability is https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff and can be reviewed to confirm the exact sanitization changes applied. If immediate upgrade is operationally blocked, restrict web server access to delete_module.php via IP allowlist or enforce authentication at the reverse proxy layer, accepting that this disables module deletion functionality for all users. A WAF rule rejecting responses that reflect POST parameter content verbatim into HTML can serve as an additional layer, though this is not a substitute for patching. Upgrade urgency is elevated beyond this single CVE: the same release patches 19 SQL injection vulnerabilities and removes 5 hardcoded credentials - any unpatched instance carries compounded critical risk.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today