CVE-2026-48230

Open ISES Tickets before 3.44.2 is affected by a reflected XSS in ticketsmdb_import.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values through multiple POST parameters (mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix, ticketshost, ticketsdb, ticketsuser, ...