The vulnerability is a reflected cross‑site scripting flaw located in os_watch.php. An authenticated attacker can submit crafted POST data via the ref and mode_orig parameters and have the unfiltered value echoed back into a hidden input field. When the victim’s browser renders the response, the injected JavaScript executes, allowing the attacker to steal session data, deface pages, or perform other malicious actions in the context of the user.

Open ISES Tickets is affected. All releases prior to version 3.44.2 contain the flaw, regardless of the environment or configuration. Users running any earlier minor or major release remain vulnerable until they upgrade to 3.44.2 or later.

The CVSS score of 5.1 indicates a moderate impact. The issue requires authenticated access; therefore an attacker must first compromise a user account before exploiting it. The EPSS score is not available and the vendor has not listed this vulnerability in the CISA KEV catalog. Nonetheless, because the flaw allows arbitrary script execution in a browser session, the potential damage to confidentiality and integrity remains significant if a legitimate user is lured to a maliciously crafted request. The risk is that authenticated users could have their session hijacked or be subjected to further malicious activity on the host system.