CVE-2026-48214 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in add_nm.php where the ticket_id POST parameter is incorporated into the HTML response without proper neutralization, enabling authenticated attackers to inject and execute arbitrary JavaScript in the context of the victim's browser session. This can lead to typical XSS impacts such as session hijacking or unauthorized actions performed by the victim. The vulnerability requires authentication and user interaction to exploit and has a medium CVSS score of 5.1. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser when viewing the affected page. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the victim. The vulnerability is limited to authenticated users and requires victim interaction to trigger the payload. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns in the ticket_id parameter. Avoid clicking on suspicious links or requests that include unexpected ticket_id values.