CVE-2026-48218

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2

Description A reflected cross-site scripting issue exists in the 'icons/buttons/landb.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the frm name and frm id POST parameters, which are then rendered directly into the HTML content and inline JavaScript. This allows a malicious payload to execute within the victim's browser upon rendering the response.

Recommendations Update to version 3.44.2 or later. Avoid using the frm name and frm id parameters in the 'icons/buttons/landb.php' endpoint until the update is applied.