Get real-time updates on Telegram
CVE-2026-48230: Tickets 0 to before 3.44.2
CVE-2026-48230. CVSS 3.1 base score 5.4 (MEDIUM, Vendor/CNA). EPSS 0.00295 (percentile 0.20978), scored 22-Oct-2026.
Affected technology
Tickets · 0 to before 3.44.2
Open ISES
Description’s affected range: before 3.44.2
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction
What an attacker can do
Authenticated attackers can inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters (mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix, ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix) directly into HTML form hidden input value attributes. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality, integrity and availability impact as none.
- CWE
- CWE-79
- CCR priority
- 21.7 /100 (P4)
- CVSS 3.1
- 5.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · Vendor/CNA
- EPSS
- 0.00295 · percentile 0.20978 · 2026-10-22
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-24 01:40:49.068977+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-48230.html