CVE-2026-35007: falha de média gravidade em openises tickets
Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single_unit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a malicious URL containing a JavaScript payload in the id parameter that executes in the victim's browser when the URL is visited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
openises · ticketsCVEs relacionadas — openises tickets
No mesmo produto, das mais perigosas para as menos.
CVE-2026-35014MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id ParameterEPSS 0.2%CVE-2026-35016MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query ParameterEPSS 0.2%CVE-2026-35015MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket ParameterEPSS 0.2%CVE-2026-35013MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng ParametersEPSS 0.2%CVE-2026-35012MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id ParameterEPSS 0.2%CVE-2026-35011MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call ParameterEPSS 0.2%