CVE-2026-48229

Open ISES Tickets before 3.44.2 contains a reflected XSS in routes_i.php that lets authenticated users inject JavaScript by passing an unsanitized value through the ticket_id GET parameter into HTML form hidden input value attributes. Payload executes when the response is rendered. Affected compo...