Is there a patch available for EUVD-2026-31302?

Yes, a patch is available for EUVD-2026-31302. Update the affected software to the latest version immediately.

Open ISES Tickets EUVD-2026-31302

Q: What is the CVSS score of EUVD-2026-31302?

EUVD-2026-31302 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-48221 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-cxv4-2vhg-j9gf

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:43 vuln.today

Analysis Generated

May 21, 2026 - 18:43 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205a.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows injection of arbitrary JavaScript via the unsanitized frm_add_str POST parameter in ics205a.php, which is rendered verbatim inside an HTML form hidden input value attribute in the victim's browser. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 release - a 'Critical Security Update' that also addressed 19 SQL injection issues and 5 hardcoded secrets, revealing systemic input handling failures across the codebase. No public exploit identified at time of analysis and no CISA KEV listing; however, the broader security debt in this application makes upgrading urgent beyond this single CVE.

Technical ContextAI

Open ISES Tickets is a PHP-based issue tracking application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant: user-supplied input from the frm_add_str POST parameter is echoed directly into an HTML hidden input's value attribute without HTML entity encoding or output sanitization. Because the parameter is POST-based, exploitation requires tricking the victim's browser into submitting a crafted form - a technique achievable via CSRF-style auto-submitting pages on attacker-controlled domains. The release notes for v3.44.2 confirm that the same root cause (missing sanitization) affected 22 separate PHP files across the codebase, patched via commit ecfeb406a016766cae81c749e14b5145a9f2dbff.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately; the vendor explicitly labels this a 'Critical Security Update - All Users Should Upgrade Immediately.' For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional deployments, download the v3.44.2 zip from https://github.com/openises/tickets/releases/tag/v3.44.2, extract over the existing installation, and run the installer in Upgrade mode. The fix is confirmed in commit ecfeb406a016766cae81c749e14b5145a9f2dbff. If an immediate upgrade is not possible, restrict access to ics205a.php via web server configuration (e.g., IP allowlist or authentication gateway at the reverse proxy layer) to reduce the attack surface - note this is a partial mitigation only since the same systemic sanitization flaw affects 21 other PHP files in the application. Deploying a WAF rule to block reflected POST-based XSS payloads targeting the frm_add_str parameter provides an additional compensating control but should not substitute for patching given the scope of vulnerabilities addressed in v3.44.2.