Reflected Cross-Site Scripting Vulnerability in Open ISES Tickets by Open ISES

CVE-2026-48219

What is CVE-2026-48219?

The Open ISES Tickets application is vulnerable to reflected cross-site scripting due to improper sanitization of user input in the ics202.php file. Authenticated attackers can exploit this vulnerability by sending crafted requests that contain JavaScript code injected via the frm_add_str POST parameter. When the manipulated data is included in the hidden input value of an HTML form, it may execute in a victim's browser, potentially leading to unauthorized actions and data theft. This vulnerability underscores the importance of robust input validation and sanitization practices in web applications.

References