CVE-2026-48217 describes a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The vulnerability exists in delete_module.php, where multiple POST parameters (module_choice, flag, confirmation) are not properly sanitized before being included in HTML output and form action attributes. An authenticated attacker can exploit this by crafting a malicious request that injects JavaScript code, which executes in the context of the victim's browser upon rendering the response. This can lead to typical XSS impacts such as session hijacking or unauthorized actions within the victim's session. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, but user interaction needed. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when viewing the affected page. This can lead to theft of sensitive information, session hijacking, or other actions performed with the victim's privileges. However, exploitation requires authentication and user interaction, limiting the attack scope. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected delete_module.php functionality to trusted users only and consider additional input validation or web application firewall rules to detect and block malicious payloads in POST parameters. Monitor vendor channels for updates regarding patches or official mitigations.