CVE-2026-48217
Deferred Deferred - Pending Action
Reflected XSS in Open ISES Tickets before 3.44.2

Publication date: 2026-05-21

Last updated on: 2026-05-21

Assigner: VulnCheck

Description
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (module_choice, flag, confirmation) directly into rendered HTML content and form action attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-21
Last Modified
2026-05-21
Generated
2026-06-11
AI Q&A
2026-05-21
EPSS Evaluated
2026-06-10
NVD
CVE-2026-48217
EUVD
EUVD-2026-31300
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Open ISES Tickets versions before 3.44.2 and is a reflected cross-site scripting (XSS) flaw in the delete_module.php file.

Authenticated attackers can exploit this by injecting arbitrary JavaScript code through unsanitized POST parameters (module_choice, flag, confirmation) that are directly included in the rendered HTML content and form action attributes.

When a victim's browser renders the response, the malicious JavaScript executes, potentially compromising the user's session or data.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript in the context of a victim's browser session.

Potential impacts include theft of user credentials, session hijacking, unauthorized actions performed on behalf of the user, and exposure of sensitive information.

Since the attacker must be authenticated, the risk is limited to users with valid access, but it still poses a significant threat to user security and data integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart