Vulnerability · Published May 20, 2026 · Assigned by VulnCheck

CVE-2026-35007Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter

Medium 4.6

In plain English

A medium-severity cross-site scripting in tickets from openises. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single_unit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a malicious URL containing a JavaScript payload in the id parameter that executes in the victim's browser when the URL is visited.

Affected products (as reported)

Vendor	Product	Versions
openises	tickets	0 – before 3.44.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/openises/tickets/releases/tag/v3.44.2 release-notes
https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff patch
https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-single-unit-php-id-parameter third-party-advisory