CVE-2026-48216 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the db_loader.php file, where multiple POST parameters (ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, db_schema) are directly embedded into HTML form input value attributes without proper neutralization. This allows an authenticated attacker to craft a malicious request containing JavaScript payloads that execute in the context of the victim's browser when the response is rendered. The vulnerability has a CVSS 4.0 score of 5.1, reflecting medium severity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation enables an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when viewing the affected page. This can lead to actions such as session hijacking, defacement, or other client-side attacks depending on the victim's privileges and browser environment. However, the attack requires authentication and user interaction to trigger the payload. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected functionality to trusted users only and consider additional input validation or output encoding controls where possible. Monitor vendor channels for updates regarding patches or official mitigations.