PT-2026-42252

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient JF.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket id GET parameter directly into a JavaScript variable assignment. Attacker...