Reflected Cross-Site Scripting Vulnerability in Open ISES Tickets by Open ISES

CVE-2026-48225

What is CVE-2026-48225?

The Open ISES Tickets application prior to version 3.44.2 is susceptible to a reflected cross-site scripting (XSS) vulnerability found in landb.php. An attacker can exploit this flaw by sending a crafted request that includes an unsanitized value through the _type POST parameter. This value can be injected directly into an HTML form's hidden input value attribute. When the response is rendered, any embedded JavaScript payload could then execute within the browser of the victim, potentially leading to session hijacking, data manipulation, or other malicious actions.

References