CVE-2026-48218 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The issue arises from improper neutralization of input in the frm_name and frm_id POST parameters within icons/buttons/landb.php. These unsanitized inputs are embedded directly into rendered HTML and inline JavaScript, enabling authenticated attackers to inject and execute arbitrary JavaScript code in the victim's browser. This vulnerability requires user interaction (UI:A) and does not require privileges (PR:N). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality, integrity, or availability impact, and low scope impact. No patch or official remediation level is currently documented.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when viewing the affected page. This can lead to session hijacking, unauthorized actions on behalf of the user, or other client-side impacts typical of reflected XSS vulnerabilities. There is no indication of direct confidentiality, integrity, or availability impact on the server or application beyond the client-side script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to trusted authenticated users only and consider applying web application firewall (WAF) rules to detect and block suspicious input patterns in the frm_name and frm_id parameters. Avoid using affected versions if possible and monitor for vendor updates.