CVE-2026-48220 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the ics205.php file, where the frm_add_str POST parameter is directly inserted into a hidden input element without proper input neutralization. This allows an authenticated attacker to craft a malicious request that injects JavaScript code, which executes in the context of the victim's browser when the page is rendered. The vulnerability requires user interaction and authentication but does not require elevated privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when they access the vulnerable page. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or other client-side attacks. However, the attack requires the attacker to be authenticated and the victim to interact with the maliciously crafted request. There are no reports of active exploitation in the wild.

No official patch or remediation has been confirmed at this time. Users should monitor the vendor's advisory channels for updates regarding a fix. Until a patch is available, consider restricting access to the vulnerable functionality to trusted users only and applying web application firewall (WAF) rules to detect and block suspicious input patterns targeting the frm_add_str parameter. Avoid exposing the vulnerable endpoint to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.