CVE-2026-48214 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the add_nm.php script where the ticket_id POST parameter is directly embedded into an HTML form input value attribute and an inline JavaScript string without proper neutralization. Authenticated attackers can exploit this by submitting specially crafted requests containing malicious JavaScript payloads, which execute in the context of the victim's browser upon rendering the response. This vulnerability requires user interaction and authentication but does not require elevated privileges.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, unauthorized actions on behalf of the victim, or other client-side attacks. The vulnerability does not require privileges beyond authentication and has a medium severity rating (CVSS 5.1). There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's announcements for patches addressing this issue. In the meantime, restricting access to trusted users and avoiding unsafe input in ticket_id parameters may reduce risk.