CVE-2026-48219 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The issue exists in the ics202.php file where the frm_add_str POST parameter is directly embedded into an HTML hidden input value without proper input neutralization. Authenticated attackers can exploit this by crafting malicious requests that inject JavaScript payloads, which execute in the context of the victim's browser when the page is rendered. This can lead to typical XSS impacts such as session hijacking or unauthorized actions performed on behalf of the victim. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). No patch or official remediation level has been disclosed by the vendor as of the published date.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, unauthorized actions, or other client-side impacts typical of reflected XSS vulnerabilities. There is no indication of privilege escalation or direct system compromise from the available data. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting access to authenticated users and monitoring for suspicious activity related to the vulnerable parameter. Avoid using untrusted input in HTML attributes without proper encoding or sanitization.