Open ISES Tickets before version 3.44.2 is vulnerable to reflected cross‑site scripting. The ticket_id GET parameter is written directly into a hidden INPUT element’s VALUE attribute without sanitization, allowing an attacker to inject arbitrary JavaScript. When a victim opens a crafted URL, the script executes in their browser, potentially enabling session hijacking, credential theft, or defacement. This vulnerability is the classic CWE‑79 reflected XSS scenario.

The affected product is Open ISES Tickets for the vendor openises:tickets. All releases older than 3.44.2 are impacted. No specific sub‑versions beyond the version cutoff are listed.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user able to access the system and the malicious URL; the attacker must craft a link containing a ticket_id payload. Once the user visits the link, the injected code runs with the victim’s browser context, providing a significant attack surface for client‑side payloads.