Open ISES Tickets before 3.44.2 reflects values from several POST parameters directly into HTML form input elements without sanitization, enabling an authenticated attacker to inject arbitrary JavaScript that is executed in the victim’s browser when the page is rendered. This reflected cross‑site scripting flaw (CWE‑79) allows malicious client‑side code to perform a range of attacks, including session hijacking, credential theft, or redirection to malicious sites.

All installations of Open ISES Tickets running a release earlier than 3.44.2 are affected. The flaw resides in db_loader.php, which processes POST parameters such as ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, and db_schema, reflecting those values directly into HTML form inputs.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated to the application and must craft a POST request that includes malicious values in the specified parameters. The need for authentication and a POST request reduces the attack surface but does not eliminate the risk, particularly if an attacker can compromise a user account or otherwise access the application.