EUVD-2026-31305
GHSA-xxw9-f9g5-745j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
AnalysisAI
Reflected cross-site scripting in Open ISES Tickets before v3.44.2 enables JavaScript injection via the frm_add_str POST parameter in ics214.php, which reflects the unsanitized value directly into an HTML form hidden input value attribute. When a victim renders the crafted response, the payload executes in their browser session, enabling session hijacking or action-on-behalf-of-user attacks. No public exploit has been identified and this CVE is not listed in CISA KEV, though the v3.44.2 release addresses 88 total vulnerabilities - including SQL injection and hardcoded credentials - making upgrade broadly critical regardless of this specific finding.
Technical ContextAI
Open ISES Tickets is a PHP-based incident/ticketing web application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a Type 1 Reflected XSS. The specific sink is within ics214.php, where the frm_add_str POST parameter is echoed without HTML encoding into a hidden form input's value attribute - a classic PHP output context failure. Because the injection lands inside an attribute value, an attacker can break out of the attribute context using a quote character followed by an event handler or script tag. The v3.44.2 release notes confirm this was one of 69 XSS vulnerabilities fixed across 22 PHP files, indicating the application lacked a consistent output encoding strategy rather than this being an isolated defect. The same release also patched 19 SQL injection issues and removed hardcoded API keys and database passwords, pointing to a systemic absence of secure coding practices throughout the codebase.
RemediationAI
The primary remediation is upgrading to Open ISES Tickets v3.44.2, available at https://github.com/openises/tickets/releases/tag/v3.44.2 and described by the vendor as a critical security update. For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional deployments, download the release zip, extract it over the existing installation, and run the built-in installer in Upgrade mode; the vendor states existing passwords will continue to work with automatic hash upgrades on next login. The specific commit addressing this vulnerability is https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. If immediate upgrade is not possible, restrict access to ics214.php via web server configuration (e.g., IP-based allow-listing in Apache/nginx) as a compensating control - note this does not address the 19 SQL injection vulnerabilities and hardcoded credentials also fixed in this release, which may represent greater immediate risk. Given the breadth of the v3.44.2 security release, partial mitigations are a poor substitute for the full upgrade.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today