---
id: CVE-2026-48230
title: >-
  Open ISES Tickets < 3.44.2 Reflected XSS via ticketsmdb_import.php Multiple
  POST Parameters
summary: >-
  Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting
  vulnerability in ticketsmdb_import.php that allows authenticated attackers to
  inject arbitrary JavaScript by passing an unsanitized value through the
  multiple POST…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Open ISES
product: Tickets
affected:
  - Tickets < 3.44.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-23T02:21:30.990835Z'
published: '2026-05-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:20.820Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-48230'
references:
  - url: 'https://github.com/openises/tickets/releases/tag/v3.44.2'
    label: Tickets 3.44.2 Release Notes
  - url: >-
      https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff
  - url: >-
      https://www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-ticketsmdb-import-php-multiple-parameters
tags:
  - cve.org
epss: 0.00212
epssPercentile: 0.11496
ingestedAt: '2026-11-08T14:51:22.402Z'
---

## Overview

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix, ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix) directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

## Affected

- `Tickets < 3.44.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.