113130 matches found
PT-2026-42499
Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'ics205a.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value via the frm add str...
PT-2026-42523
Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud...
PT-2026-42515
Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description An issue exists in the message.php file where the frm ticket id and frm resp id POST parameters are concatenated into WHERE clauses of SELECT and UPDATE statements without proper...
CVE-2026-48219: Improper Neutralization of Input During Web Page Generation
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics202.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmaddstr POST parameter directly into an HTML form hidden input value attribute...
Tickets: Cross-site scripting vulnerabilities
Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the circular.php file, where the frmid POST parameter was directly inserted into...
PT-2026-42500
Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'ics213.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value via the frm add str PO...
PT-2026-42504
Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'os watch.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the ref and mo...
Tickets: Cross-site scripting vulnerabilities
Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of the ticketid GET parameter in routesi.php, allowing uncleaned values t...
Tickets: Cross-site scripting vulnerabilities
Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of the id and ticketid GET parameters in the patientw.php file, allowing...
CVE-2026-48243: Use of Hard-coded Credentials
Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the origin...
Linux Distros Unpatched Vulnerability : CVE-2026-46637
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with issafe = all, causing...
Linux Distros Unpatched Vulnerability : CVE-2026-46635
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP arraycolumn, which reads public and magic properties without...
Linux Distros Unpatched Vulnerability : CVE-2026-46640
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string int...
PT-2026-42493
Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'circle.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value through the frm id POS...
Tickets: Cross-site scripting vulnerabilities
Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the fact that the frmaddstr POST parameter was not cleared in icc202.php, allowin...
PT-2026-42497
Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description Authenticated attackers can perform a reflected cross-site scripting attack via the 'ics202.php' endpoint. The issue occurs when an unsanitized value is passed through the frm add str POST...
CVE-2026-35008
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...
EUVD-2026-31190
Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile that leads to Local File Inclusion. The function calls extract$params, EXTROVERWRITE before the require statement that loads the view file. As a result, a...
