CVE-2026-48230 | THREATINT

Description

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix, ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix) directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

PUBLISHED Reserved 2026-05-21 | Published 2026-05-21 | Updated 2026-05-23 | Assigner VulnCheck

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status

unaffected

Any version before 3.44.2

affected

References

github.com/openises/tickets/releases/tag/v3.44.2 release-notes

github.com/...ommit/ecfeb406a016766cae81c749e14b5145a9f2dbff patch

www.vulncheck.com/...cketsmdb-import-php-multiple-parameters third-party-advisory

cve.org (CVE-2026-48230)

nvd.nist.gov (CVE-2026-48230)

Download JSON