CVE-2026-48217 Details
Description
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (module_choice, flag, confirmation) directly into rendered HTML content and form action attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
A reflected cross-site scripting vulnerability has been identified in Open ISES Tickets versions prior to 3.44.2. The issue resides in delete_module.php, where authenticated attackers can inject arbitrary JavaScript. This is achieved by sending an unsanitized value through several POST parameters (module_choice, flag, confirmation), which is then directly inserted into the rendered HTML content and form action attributes. As a result, attackers can execute JavaScript payloads in the context of the victim's browser when the response is displayed.
Users are advised to upgrade to Open ISES Tickets version 3.44.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 21, 2026CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff | [email protected] | Source CodeVendor |
| https://github.com/openises/tickets/releases/tag/v3.44.2 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-delete-module-php-multiple-parameters | [email protected] | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Open ISES Tickets | < 3.44.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | New CVE Received | [email protected] |