CVE-2026-35014

Open ISES Tickets before 3.44.2 is affected by a reflected XSS in routes_nm.php. The vulnerability allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value in the ticket_id GET parameter, which is placed into a hidden input VALUE attribute and executed in the ...