CVE-2026-48221 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the ics205a.php file where the frm_add_str POST parameter is directly inserted into a hidden input value attribute without proper neutralization. Authenticated attackers can exploit this by sending a specially crafted request containing JavaScript payloads that execute in the context of the victim's browser, potentially leading to session hijacking or other client-side attacks. No official patch or remediation level is currently documented.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing the affected page. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability requires authentication and user interaction (UI), limiting its impact somewhat. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider implementing input validation or output encoding on the frm_add_str parameter as a temporary mitigation. Monitor vendor channels for updates regarding an official patch.