CVE-2026-48224
Reflected XSS in Open ISES Tickets via frm_add_str Parameter
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-48224 is a reflected cross-site scripting (XSS) vulnerability found in Open ISES Tickets versions before 3.44.2, specifically in the ics214.php file.
The vulnerability occurs because the frm_add_str POST parameter accepts input that is not properly sanitized and directly inserted into an HTML form's hidden input value attribute.
An authenticated attacker can exploit this by crafting a malicious request containing JavaScript code that will execute in the victim's browser when the response is rendered.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser.
Such an attack can lead to session hijacking, theft of sensitive information, or performing actions on behalf of the victim without their consent.
Since the attacker must be authenticated, the risk is somewhat limited to users with access, but it still poses a significant security threat.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the ics214.php endpoint for reflected cross-site scripting via the frm_add_str POST parameter. An authenticated request can be crafted to send a JavaScript payload in the frm_add_str parameter and observe if the payload is reflected and executed in the response.
A possible detection method is to use tools like curl or Burp Suite to send a POST request with a JavaScript payload in the frm_add_str parameter and check if the payload appears unsanitized in the HTML response.
- Example curl command to test the vulnerability (replace URL and authentication as needed):
- curl -X POST -d "frm_add_str=<script>alert('XSS')</script>" -b "cookie=your_auth_cookie" https://targetsite/ics214.php -v
- Check the response HTML for the injected script tag inside the hidden input value attribute.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update Open ISES Tickets to version 3.44.2 or later, where this vulnerability has been fixed.
Until the update can be applied, restrict access to the affected ics214.php page to trusted authenticated users only, and consider implementing web application firewall (WAF) rules to detect and block suspicious payloads in the frm_add_str POST parameter.