Open ISES Tickets prior to version 3.44.2 contains a reflected cross‑site scripting flaw that derives its payload from the unsanitized POST parameter frm_add_str in ics205.php. An attacker who is authenticated to the application can supply a malicious string that is echoed back into the value attribute of a hidden form field, resulting in the browser executing the injected code in the context of the victim's session. This can lead to cookie theft, session hijacking, and other downstream attacks driven by the victim's privileges.

All installations of Open ISES Tickets running a version older than 3.44.2 are affected. The vulnerability exists in the default configuration of the ics205.php component and applies broadly to any instance that permits authenticated users to submit form data using the frm_add_str field.

The CVSS score of 5.1 indicates a moderate severity for this reflected XSS. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must first authenticate to the application, after which they can issue a crafted HTTP POST request to trigger the flaw. Because the payload is reflected directly into the page, exploitation is straightforward and does not require complex setup or elevated privileges on the target server.