CVE-2026-48215 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the circle.php script where the frm_id POST parameter is directly embedded into an HTML form input value attribute without proper neutralization. Authenticated attackers can exploit this by sending a specially crafted request containing JavaScript payloads that execute in the context of the victim's browser upon rendering the response. This vulnerability can lead to script execution but requires user interaction and authentication.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when they view the affected page. This can lead to session hijacking, unauthorized actions, or other client-side attacks. However, the attack requires the attacker to be authenticated and the victim to interact with the maliciously crafted response. There are no known exploits in the wild at this time.

No official patch or remediation is currently documented. Users should monitor the vendor's advisories for updates and apply any future patches addressing this vulnerability. Until a fix is available, restricting access to trusted users and minimizing exposure of the vulnerable endpoint may reduce risk. Avoid interacting with untrusted or suspicious POST requests targeting the frm_id parameter.