Open ISES:Tickets contains a reflected cross‑site scripting flaw in the ics202.php handler. An authenticated attacker can supply an unsanitized value in the frm_add_str POST parameter that is echoed verbatim into a hidden input element of an HTML form. When the victim’s browser renders the response, the supplied payload executes in the context of the authenticated session, allowing the attacker to steal session cookies, read or modify user data, or perform arbitrary actions on behalf of the user.

The vulnerability affects all Open ISES:Tickets releases older than version 3.44.2. Any deployment that exposes the ics202.php endpoint and accepts a frm_add_str parameter without proper input sanitization is susceptible until the application is upgraded to 3.44.2 or later.

The CVSS base score of 5.1 indicates moderate severity. Exploitation requires a valid authenticated user and can be performed remotely via an HTTP POST request. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the current likelihood of widespread exploitation is low, though the impact of a successful attack can be significant for individual users. Prompt remediation is recommended to prevent attackers from running malicious code in victims’ browsers.