The vulnerability is a reflected cross‑site scripting flaw in the ics213.php component. It allows an attacker who already has authenticated access to the application to supply an unfiltered value in the frm_add_str POST parameter. When the response is rendered, the unsanitized input is inserted directly into an HTML form hidden input attribute, causing any embedded JavaScript to execute in the victim’s browser.

Affected are all instances of Open ISES Tickets running any version earlier than 3.44.2. The vulnerability has been addressed in the 3.44.2 release, as noted in the project’s GitHub tags and commit history.

The CVSS score of 5.1 indicates moderate severity; the EPSS score is not available and the issue is not listed in CISA KEV, implying no widespread exploitation. Since exploitation requires an authenticated session, the risk is limited to users with legitimate access credentials. Organizations should treat this as an internal threat that can lead to session hijacking, phishing, or data leakage if an attacker can inject malicious scripts into users’ browsers.