CVE-2026-48218 MEDIUM

CVE-2026-48218: Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters

Vendor Open Ises
Product Tickets
Weakness CWE-79 · XSS
Published May 21, 2026
Last update July 28, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_name and frm_id POST parameters directly into rendered HTML content and inline JavaScript. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

Key dates

02Disclosure timeline

May 21, 2026 CVE published
July 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-66687 WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-13360 Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter CVE-2026-2487 Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting CVE-2026-66646 WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability CVE-2026-75948 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12