CVE-2026-48220 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the ics205.php file where the frm_add_str POST parameter is directly embedded into a hidden input field in an HTML form without proper input neutralization. Authenticated attackers can exploit this by sending a specially crafted request containing JavaScript code, which executes in the victim's browser upon rendering the response. This can lead to client-side script execution under the victim's privileges.

The vulnerability allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or other client-side attacks. However, exploitation requires authentication, which limits the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.44.2, upgrading to version 3.44.2 or later is recommended once a fix is available. Until then, restrict access to trusted users and monitor for suspicious activity involving the frm_add_str parameter.