Open ISES Tickets versions prior to 3.44.2 permit authenticated users to embed unsanitized input from the "id" and "ticket_id" GET parameters into an HTML form action. This flaw allows an attacker to inject JavaScript that executes in the victim’s browser when the page is rendered. The injected code runs with the privileges of the logged‑in user, enabling theft of session cookies, defacement of pages, or redirection to malicious sites.

The vulnerability affects the Open ISES Tickets product. Any deployment of this software with a version earlier than 3.44.2 is susceptible. The vendor’s own release notes indicate that the patch was applied in the 3.44.2 release.

The CVSS score of 5.1 classifies the issue as moderate, reflecting that exploitability requires authentication and that it is primarily an in‑browser attack. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it has not been widely exploited yet. An attacker would need to craft a malicious URL containing a JavaScript payload; if a legitimate user clicks or is tricked into visiting it, the script will run in the victim’s session. The lack of a public exploit does not preclude future abuse once the flaw is disclosed widely.