CVE-2026-35016: medium-severity vulnerability in openises tickets
Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.2%
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_query POST parameter directly into an HTML input field VALUE attribute. Attackers can craft a malicious request containing a JavaScript payload in the frm_query parameter that executes in the victim's browser when submitted.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
openises · ticketsRelated CVEs — openises tickets
In the same product, most dangerous first.
CVE-2026-35014MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id ParameterEPSS 0.2%CVE-2026-35015MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket ParameterEPSS 0.2%CVE-2026-35013MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng ParametersEPSS 0.2%CVE-2026-35012MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id ParameterEPSS 0.2%CVE-2026-35011MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call ParameterEPSS 0.2%CVE-2026-35010MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id ParameterEPSS 0.2%