CVE-2026-48219 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets versions prior to 3.44.2. The issue exists in the ics202.php file where the frm_add_str POST parameter is directly inserted into a hidden input field without proper neutralization. Authenticated attackers can exploit this by crafting a malicious request that injects JavaScript code, which executes in the context of the victim's browser upon rendering the response. This can lead to typical XSS impacts such as session hijacking or unauthorized actions performed on behalf of the victim.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when viewing the affected page. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the victim's privileges. The vulnerability requires authentication and user interaction (the victim must load the crafted page).

No official patch or remediation level has been confirmed at this time. Users should upgrade to Open ISES Tickets version 3.44.2 or later once available, as this version is indicated as the fixed release. Until then, apply input validation and output encoding on the frm_add_str parameter to neutralize potentially malicious input. Monitor vendor advisories for official patches or updates.