CVE-2026-35012: fallo de gravedad media en openises tickets
Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.2%
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a hidden input field VALUE attribute. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim's browser when the URL is visited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
openises · ticketsCVEs relacionadas — openises tickets
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-35014MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id ParameterEPSS 0.2%CVE-2026-35016MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query ParameterEPSS 0.2%CVE-2026-35015MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket ParameterEPSS 0.2%CVE-2026-35013MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng ParametersEPSS 0.2%CVE-2026-35011MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call ParameterEPSS 0.2%CVE-2026-35010MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id ParameterEPSS 0.2%