CVE-2026-48216 Open ISES Tickets < 3.44.2 Reflected XSS via db_loader.php Multiple POST Parameters

🗓️ 21 May 2026 17:09:19Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Authenticated attackers can exploit reflected XSS in Open ISES Tickets before 3.44.2 via db_loader.php with unsanitized POST parameters.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-48216	21 May 202617:09	–	attackerkb
CNNVD	tickets 跨站脚本漏洞	21 May 202600:00	–	cnnvd
CVE	CVE-2026-48216	21 May 202617:09	–	cve
Cvelist	CVE-2026-48216 Open ISES Tickets < 3.44.2 Reflected XSS via db_loader.php Multiple POST Parameters	21 May 202617:09	–	cvelist
EUVD	EUVD-2026-31294	21 May 202617:09	–	euvd
NVD	CVE-2026-48216	21 May 202618:16	–	nvd
Positive Technologies	PT-2026-42494	21 May 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-48216 Open ISES Tickets < 3.44.2 Reflected XSS via db_loader.php Multiple POST Parameters	21 May 202617:09	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48216.json
github	www.github.com/openises/tickets/releases/tag/v3.44.2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48216
vulncheck	www.vulncheck.com/advisories/open-ises-tickets-reflected-xss-via-db-loader-php-multiple-parameters
github	www.github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff

08 Jul 2026 08:13Current

6Medium risk

Vulners AI Score6

CVSS 45.1

EPSS0.00212