CVE-2026-48214 Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in addnm.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid POST parameter directly into an HTML form input value attribute and an inlin...

CVE-2026-48214 Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in addnm.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid POST parameter directly into an HTML form input value attribute and an inlin...

CVE-2026-48213 Open ISES Tickets < 3.44.2 Reflected XSS via add.php ticket_id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid POST parameter directly into an HTML form input value attribute. Attackers can...

CVE-2026-6841 Reflected XSS in Request Tracker

Request Tracker is vulnerable to a reflected cross-site scripting XSS vulnerability via the "Page" parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser. This vulnerability affects versions from 5.0.4 up to 5.0....

PT-2026-42508

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'ticketsmdb import.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the...

PT-2026-42504

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'os watch.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the ref and mo...

CVE-2026-35016

Open ISES Tickets prior to 3.44.2 is vulnerable to a reflected XSS in search.php. The issue arises when an unsanitized value is passed via the frm_query POST parameter, which gets injected into an HTML input field VALUE attribute and echoed back to the user. Exploitation requires authentication a...

CVE-2026-35012

Open ISES Tickets prior to 3.44.2 is affected by a reflected XSS in add_facnote.php. The vulnerability arises when an unsanitized ticket_id value is injected via the GET parameter and placed into a hidden input field VALUE attribute, allowing an authenticated attacker to craft a URL that executes...

CVE-2026-35012 Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in addfacnote.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into a hidden input field VALUE attribute...

CVE-2026-35011 Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmcall GET parameter directly into page output. Attackers can craft a malicious URL...

CVE-2026-35010

Open ISES Tickets before 3.44.2 is affected by a reflected XSS in patient_JF.php via the ticket_id GET parameter, where an unsanitized value leads to arbitrary JavaScript execution in an authenticated user’s browser. The issue is triggered by visiting a crafted URL containing a JavaScript payload...

CVE-2026-35009 Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in addnote.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into a hidden input field VALUE attribute. Attacker...

CVE-2026-35009 Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in addnote.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into a hidden input field VALUE attribute. Attacker...

CVE-2026-35008

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...

CVE-2026-35008 Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...

CVE-2026-35008

CVE-2026-35008 affects Open ISES Tickets prior to version 3.44.2. The vulnerability is a reflected XSS in single.php where an unsanitized ticket_id GET parameter is echoed into an HTML attribute, enabling an authenticated attacker to inject arbitrary JavaScript via a crafted URL. Impact is descri...

CVE-2026-35007 Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in singleunit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a maliciou...

CVE-2026-35007 Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in singleunit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a maliciou...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks occur when a malicious script is reflected from a web application into the victim’s browser. The script can be activated through action form fields, which are sent as requests to a website with vulnerabilities that allow the execution of malicious scripts...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected from a web application to the victim’s browser. The script is activated through a link, which sends a request to a website with a vulnerability that allows the execution of malicious scripts...