CVE-2007-2801: Multiple cross-site scripting (XSS) vulnerabilities in open.php in eTicket 1.5.5 and 1.5.5.1, when register...

Security readout for executives and security teams

This is an older reflected XSS issue in eTicket 1.5.5 and 1.5.5.1. It only applies when PHP register_globals is enabled, a condition the vendor said eTicket was not designed to support. Successful abuse could expose users to injected script or HTML in the helpdesk application. Exposure is likely limited to legacy eTicket 1.5.5 or 1.5.5.1 deployments running with register_globals enabled and reachable by users or attackers. Modern PHP environments are less likely to be affected because register_globals is obsolete. Handle during legacy application risk review unless the affected system is internet-facing or business-critical. Prioritize faster if eTicket is exposed externally, handles sensitive support data, or still runs with register_globals enabled. Mitigation focus: Identify any running eTicket 1.5.5 or 1.5.5.1 instances.; Disable PHP register_globals where still present.; Check vendor or maintainer guidance for available fixes or supported replacements..

Prepared

Jun 29, 2026, 04:47 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.