Open ISES Tickets before version 3.44.2 contains a reflected cross‑site scripting flaw in do_unit_mail.php that lets an authenticated attacker inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. The attacker crafts a URL embedding malicious JavaScript in the_ticket; when a user opens that URL the script runs in their browser. This can lead to theft of session cookies, credential hijacking, defacement, or other client‑side attacks. The weakness is a user‑input handling flaw (CWE‑79).

Vendors: openises tickets. Suited for versions older than 3.44.2; any installation of Open ISES Tickets where the do_unit_mail.php endpoint is reachable and accepts the_ticket parameters is vulnerable. The product is a web‑based issue tracking system.

CVSS is 5.1, indicating moderate severity. The EPSS score is not available, so current exploitation probability is unknown, but the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to be authenticated to the system and to create a malicious URL that a victim will visit; the attacker can then influence what JavaScript executes in the victim’s browser. Because the flaw is reflected, it does not require permanent infection or server‑side code execution, but it does allow attackers to perform client‑side attacks in targeted users.