CVE-2026-35016
Reflected XSS in Open ISES Tickets search.php
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-35016 is a reflected cross-site scripting (XSS) vulnerability found in Open ISES Tickets versions before 3.44.2. It occurs in the search.php file where the frm_query POST parameter is not properly sanitized. Authenticated attackers can inject arbitrary JavaScript code through this parameter, which then gets executed in the victim's browser when the malicious request is submitted.
How can this vulnerability impact me? :
This vulnerability allows authenticated attackers to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various impacts such as theft of session cookies, user impersonation, or performing actions on behalf of the victim. Since the attack requires authentication, it targets users with access to the system, potentially compromising sensitive information or user accounts.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the search.php endpoint of Open ISES Tickets for reflected cross-site scripting (XSS) via the frm_query POST parameter.
A common approach is to send a crafted POST request with a JavaScript payload in the frm_query parameter and observe if the payload is reflected and executed in the response.
For example, using curl to test the vulnerability:
- curl -X POST -d "frm_query=<script>alert('XSS')</script>" https://target-site/search.php -b cookies.txt -c cookies.txt
Note that authentication is required, so you must include valid session cookies or credentials in the request.
If the response contains the injected script within the HTML input field's VALUE attribute and it executes in the browser, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Open ISES Tickets to version 3.44.2 or later, where this reflected XSS vulnerability has been fixed.
Until the upgrade can be applied, restrict access to the affected search.php functionality to trusted users only, as exploitation requires authentication.
Additionally, consider implementing web application firewall (WAF) rules to detect and block suspicious payloads in the frm_query POST parameter.
Educate users to be cautious of unexpected or suspicious links that might trigger the vulnerability.