Is there a patch available for EUVD-2026-31307?

Yes, a patch is available for EUVD-2026-31307. Update the affected software to the latest version immediately.

Open ISES Tickets EUVD-2026-31307

Q: What is the CVSS score of EUVD-2026-31307?

EUVD-2026-31307 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-48227 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-mwhq-jcwc-pqhp

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:44 vuln.today

Analysis Generated

May 21, 2026 - 18:44 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id and ticket_id GET parameters directly into an HTML form action URL. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected XSS in Open ISES Tickets before 3.44.2 exposes authenticated users to arbitrary JavaScript execution via unsanitized GET parameters in patient.php. The vulnerability exists in the id and ticket_id parameters, whose values are written directly into an HTML form action URL without output encoding, enabling an attacker to craft a malicious link that executes script in the victim's browser upon rendering. No public exploit or active exploitation has been identified at time of analysis; however, the vendor's v3.44.2 release confirms this is one of 69 XSS vulnerabilities patched simultaneously, indicating systemic input-handling failures across the application.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a reflected XSS subclass where user-supplied input is echoed back into the response without proper HTML-context encoding. Specifically, the id and ticket_id values from GET parameters are interpolated into the action attribute of an HTML form tag in patient.php without sanitization or encoding. PHP applications are particularly prone to this class when output is constructed via direct string concatenation rather than templating engines with auto-escaping. The v3.44.2 release notes confirm the codebase contained 69 such XSS vulnerabilities across 22 files, suggesting the root cause is a pervasive lack of an output-encoding standard throughout the application rather than an isolated oversight.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately; this is a vendor-confirmed patched release available at https://github.com/openises/tickets/releases/tag/v3.44.2 and addresses 88 total vulnerabilities including 69 XSS and 19 SQL injection issues. The specific code fix is available at commit ecfeb406a016766cae81c749e14b5145a9f2dbff (https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). For Docker deployments, upgrade via 'docker compose pull && docker compose up -d'. For traditional deployments, download the v3.44.2 zip, extract over the existing install, and run the installer in Upgrade mode. If immediate upgrade is not possible, restrict access to patient.php at the web server or WAF layer to authenticated internal users only, which limits the attacker's ability to deliver a crafted link to a valid session holder - note this does not eliminate the vulnerability but reduces the attack surface. Given the 19 co-patched SQL injection vulnerabilities, the application should be considered broadly compromised until v3.44.2 is applied.