Open ISES Tickets before version 3.44.2 contains a reflected cross‑site scripting flaw in street_view.php that allows an authenticated attacker to inject arbitrary JavaScript via the unsanitized GET parameters thelat and thelng. When a victim visits a crafted URL, the payload is executed in the victim’s browser, enabling malicious actions such as defacement, cookie theft, or credential compromise.

All installations of Open ISES Tickets with versions older than 3.44.2 are affected. The ticketing system is identified by the product name tickets from the vendor openises.

The CVSS score of 5.1 indicates a moderate severity. Exploitability requires an attacker to be authenticated to the system, but a successful exploit can be triggered simply by convincing the victim to open a malicious link. Because the EPSS is not available and the vulnerability is not listed in the KEV catalog, the likelihood of widespread exploitation is uncertain, yet the potential impact on user session integrity and data confidentiality warrants prompt attention.