The vulnerability in Open ISES:Tickets allows an authenticated user to send a crafted POST request to ics214.php that includes an unsanitized frm_add_str value. The value is reflected directly into a hidden input field in the HTML response, causing any JavaScript contained in the parameter to execute in the victim’s browser when the form is rendered. This can lead to session hijacking, phishing, or arbitrary code execution within the user’s environment.

All installations of Open ISES:Tickets older than version 3.44.2 are affected. The vendor’s release notes for v3.44.2 indicate that the flaw has been fixed. No other product versions are mentioned as affected in the advisory.

The CVSS score of 5.1 places the issue in the moderate risk range, and exploitation requires authentication, which narrows the threat surface. Because no EPSS score is available and the vulnerability is not listed in the KEV catalog, there are no known public exploitation incidents to date. Nonetheless, the ability to run arbitrary JavaScript in users’ browsers remains a real concern for sites with active user interactions and should be addressed promptly.