CVE-2026-48213 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the add.php page where the ticket_id POST parameter is directly inserted into an HTML form input value attribute without proper neutralization. Authenticated attackers can exploit this by crafting a malicious request containing JavaScript code that executes in the context of the victim's browser, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity, and requires user interaction for exploitation.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser within the context of the vulnerable web application. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the victim. However, the attack requires authentication and user interaction, which limits the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.44.2, upgrading to version 3.44.2 or later is recommended once a fix is available. Until then, restrict access to trusted users and monitor for suspicious activity. Avoid relying solely on user input without proper sanitization in web applications.