CVE-2026-48218
Reflected XSS in Open ISES Tickets
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-48218 is a reflected cross-site scripting (XSS) vulnerability found in Open ISES Tickets versions before 3.44.2, specifically in the file icons/buttons/landb.php.
Authenticated attackers can exploit this flaw by injecting arbitrary JavaScript code through unsanitized POST parameters named frm_name and frm_id.
The injected JavaScript payload is then executed in the victim's browser when the server response is rendered, due to the lack of proper input sanitization and neutralization.
How can this vulnerability impact me? :
This vulnerability allows attackers to execute arbitrary JavaScript code in the context of a victim's browser session.
Such execution can lead to theft of sensitive information, session hijacking, or performing actions on behalf of the victim within the affected application.
Since the vulnerability requires authentication, attackers must have some level of access, but the impact can still be significant within that scope.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the affected endpoint icons/buttons/landb.php for reflected cross-site scripting (XSS) by sending POST requests with crafted JavaScript payloads in the frm_name and frm_id parameters and observing if the payload is executed in the response.
For example, you can use curl commands to send POST requests with test payloads to check if the input is reflected unsanitized:
- curl -X POST -d "frm_name=<script>alert(1)</script>&frm_id=test" https://target-system/icons/buttons/landb.php -v
- curl -X POST -d "frm_name=test&frm_id=<script>alert(1)</script>" https://target-system/icons/buttons/landb.php -v
If the response contains the injected script tags and the JavaScript executes in a browser, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Open ISES Tickets to version 3.44.2 or later, where this reflected XSS vulnerability has been fixed.
Until an upgrade can be applied, restrict access to the affected endpoint to trusted authenticated users only, and consider implementing web application firewall (WAF) rules to detect and block suspicious payloads in the frm_name and frm_id POST parameters.
Additionally, review and apply input validation and output encoding on the frm_name and frm_id parameters to prevent injection of arbitrary JavaScript.