CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in patient.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized id and ticket_id GET parameters that are directly placed into the action attribute of an HTML form.
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in os_watch.php. An authenticated attacker can inject arbitrary JavaScript via unsanitized ref and mode_orig POST parameters that are directly placed into the value attributes of hidden HTML form inputs.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in landb.php. An authenticated attacker can inject arbitrary JavaScript via the _type POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php. It allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics213rr.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics213.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics205a.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics205.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in ics202.php. An authenticated attacker can inject arbitrary JavaScript via the frm_add_str POST parameter, which is directly placed into an HTML form hidden input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in icons/buttons/landb.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values in POST parameters frm_name and frm_id, which are directly rendered into HTML and inline JavaScript.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in delete_module.php. An authenticated attacker can inject arbitrary JavaScript via multiple POST parameters (module_choice, flag, confirmation) that are directly placed into rendered HTML content and form action attributes.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in db_loader.php. An authenticated attacker can inject arbitrary JavaScript by passing unsanitized values in POST parameters (ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, db_schema) directly into HTML form input value attributes.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in circle.php. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value in the frm_id POST parameter directly into an HTML form input value attribute.
Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_nm.php. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value in the ticket_id POST parameter directly into an HTML form input value attribute and an inline JavaScript string literal.
The HAPPY plugin from VillaTheme up to version 1.0.10 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Open ISES Tickets before 3.44.2 contains a reflected XSS vulnerability in add.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id POST parameter that is directly placed into the value attribute of an HTML form input.
A buffer overflow vulnerability in Uncrustify (version v.Uncrustify_d-0.82.0-132-bcc41cbdc) exists in the check_template function, tokenize_cleanup function, and check_template.cpp file. A local attacker can cause a denial of service.
Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute Force. This issue affects Mobile Application: from 1.6.2 before 1.13.
Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking. This issue affects Mobile Application: from 1.6.2 before 1.13.
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents. The attack requires access to the server and prior administrative credentials.