Open ISES Tickets before version 3.44.2 contains a reflected cross‑site scripting flaw in add.php. An authenticated attacker can send a crafted POST request with an unsanitized ticket_id parameter, and the supplied JavaScript is reflected back into a form value attribute. When the response is rendered, the code executes in the victim’s browser, enabling session hijacking, credential theft, or defacement.

The vulnerability affects the Open ISES:Tickets application. All deployments running a version older than 3.44.2 are potentially impacted, including any environment where authenticated users can access the add.php endpoint.

The CVSS score of 5.1 denotes moderate severity. EPSS data is not available and the flaw is not listed in CISA KEV, indicating no documented mass exploitation. An attacker must be authenticated and able to craft a POST request to /add.php. The exploit causes code to run in the victim’s browser when the response is seen. It is inferred that user interaction, such as clicking a malicious link, is necessary to trigger the reflected payload, as the description does not explicitly state the interaction requirement.