Open ISES Tickets before version 3.44.2 contains a reflected cross‑site scripting flaw. An authenticated attacker can supply an arbitrary JavaScript payload in the ticket_id GET parameter that is inserted unescaped into a hidden input field and executed when a victim’s browser loads the page. This enables the attacker to steal session cookies, hijack user accounts, or inject malicious content into the user’s session.

The vulnerability affects all installations of Open ISES:Tickets with a version less than 3.44.2. No specific sub‑version list is provided beyond the cutoff at 3.44.2.

The CVSS base score of 5.1 indicates moderate severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The attack requires that the attacker be authenticated to the application; once authenticated, the attacker can craft a malicious request that forces the victim’s browser to execute payloads on any page that includes the ticket_id parameter. The combination of authentication, lack of input sanitization, and browser execution results in a moderate to high risk within the compromised environment.