Open ISES Tickets versions prior to 3.44.2 have a reflected cross‑site scripting flaw in the search.php page. An authenticated user can supply an unsanitized value via the frm_query POST parameter, which is inserted directly into an HTML input field VALUE attribute. When the search form is submitted, the embedded JavaScript runs in the victim’s browser, allowing the attacker to execute arbitrary code within that context. The impact is limited to client‑side execution and may include defacement or cookie theft, but it does not grant direct server‑side control or data exfiltration. The weakness is identified as CWE‑79.

The vulnerability affects the openises Tickets application, any installation running a version older than 3.44.2. No specific patch level list is provided beyond the release tag v3.44.2.

The CVSS score of 5.1 indicates a moderate severity risk. EPSS is not listed, so an exploit probability estimate is unavailable. The flaw is not in the CISA KEV catalog. Attackers must first authenticate to the system and use the search feature to trigger the payload. Once the malicious request is made, the victim’s browser executes the code, resulting in client‑side compromise. The exploit requires no special privileges beyond authentication and no out‑of‑band technique. Overall, the risk is moderate with moderate exploitability for authenticated users.