CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
Open ISES Tickets before version 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ticketsmdb_import.php. An authenticated attacker can inject arbitrary JavaScript via multiple POST parameters that are directly placed into HTML form hidden input value attributes.
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in routes_i.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the value attribute of a hidden HTML form input.
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in patient_w.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized id and ticket_id GET parameters that are directly placed into the action attribute of an HTML form.
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in patient.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized id and ticket_id GET parameters that are directly placed into the action attribute of an HTML form.
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in os_watch.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized ref and mode_orig POST parameters that are directly placed into the value attributes of hidden HTML form inputs.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in landb.php. An authenticated attacker can inject arbitrary JavaScript via the _type POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php. It allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics213rr.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics213.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics205a.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics205.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics202.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in icons/buttons/landb.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values in POST parameters frm_name and frm_id, which are directly rendered into HTML and inline JavaScript.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in delete_module.php. An authenticated attacker can inject arbitrary JavaScript via multiple POST parameters (module_choice, flag, confirmation) that are directly placed into rendered HTML content and form action attributes.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in db_loader.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values in POST parameters (ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, db_schema) directly into HTML form input value attributes.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in circle.php. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value in the frm_id POST parameter directly into an HTML form input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_nm.php. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value in the ticket_id POST parameter directly into an HTML form input value attribute and an inline JavaScript string literal.
The HAPPY plugin from VillaTheme up to version 1.0.10 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in add.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id POST parameter that is directly placed into the value attribute of an HTML form input.