CVE-2026-35015mediumCWE-79

CVE-2026-35015: falha de média gravidade em openises tickets

Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Tickets

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.2%
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the the_ticket parameter that executes in the victim's browser when the URL is visited.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
openises · tickets
CVEs relacionadas — openises tickets

No mesmo produto, das mais perigosas para as menos.

CVE-2026-35014MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id ParameterEPSS 0.2%CVE-2026-35016MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query ParameterEPSS 0.2%CVE-2026-35013MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng ParametersEPSS 0.2%CVE-2026-35012MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id ParameterEPSS 0.2%CVE-2026-35011MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call ParameterEPSS 0.2%CVE-2026-35010MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id ParameterEPSS 0.2%