Open ISES Tickets before version 3.44.2 contains a reflected cross‑site scripting flaw in the ics213rr.php script. When an authenticated user sends a POST request with the frm_add_str parameter, the value is inserted unsanitized into a hidden input field’s value attribute. Because the parameter value is reflected in the HTML of the response, an attacker can embed arbitrary JavaScript that executes in the victim’s browser when the page is rendered. The flaw requires authentication but does not specify any further privileges.

Open ISES:Tickets versions prior to 3.44.2 are affected.

The CVSS score of 5.1 indicates a moderate level of risk. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The flaw is limited to authenticated sessions, so the attack surface is restricted to users with valid credentials; however, once authenticated, an attacker can send malicious POST requests to inject JavaScript. The impact is limited to the victim’s browser session during rendering of the response.