Open ISES Tickets before version 3.44.2 contains a reflected cross‑site scripting flaw in delete_module.php that lets attackers who are already authenticated inject arbitrary JavaScript by supplying unsanitized values for the POST parameters module_choice, flag and confirmation. The injected script is reflected back in the page’s HTML and form action attributes, enabling the attacker to execute code in the victim’s browser. This can lead to cookie theft, session hijacking, defacement or other client‑side compromise for any user who views the affected page.

The vulnerability affects all releases of Open ISES Tickets older than 3.44.2, regardless of deployment platform. Users of the Open ISES:Tickets product running any pre‑3.44.2 version are exposed.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified but there is no evidence of widespread attacks. The flaw is not listed in CISA’s KEV catalog. Attackers must first authenticate to the web interface; once credentials are obtained or gained via social engineering, they can craft a malicious POST request to delete_module.php, which is both straightforward and does not require advanced privileges. The likely attack vector is a web‑based attack originating from a compromised user session.