Open ISES Tickets versions before 3.44.2 contain a reflected cross‑site scripting vulnerability in the ics205a.php endpoint. A malicious value assigned to the frm_add_str POST field is copied unchecked into the value attribute of a hidden form input, enabling an attacker to inject JavaScript that executes in the victim’s browser when the response is rendered. This flaw allows the attacker to compromise confidentiality and integrity of the victim’s session, potentially leading to credential theft or further exploitation.

The affected product is Open ISES Tickets from the vendor Open ISES. All releases preceding version 3.44.2 are susceptible. The official release that mitigates the flaw is 3.44.2, available on the vendor’s repository and release page.

The CVSS score of 5.1 indicates a medium risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to exploit the flaw, as the vulnerable functionality requires logged‑in users. The vulnerability can be triggered by submitting a crafted HTTP POST payload to ics205a.php, which then renders the injected script in the victim’s browser. The limited exploitation surface and absence of a public tool reduce the likelihood of widespread attacks but the medium severity warrants replacement with the patched version.