CVE-2026-48221 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The vulnerability exists in the ics205a.php file, where the frm_add_str POST parameter is directly embedded into a hidden input field without proper input neutralization. This allows an authenticated attacker to craft a malicious request that injects JavaScript code, which executes in the context of the victim's browser when the page is rendered. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). No vendor advisory or patch information is currently available, and the product is not a cloud service. No known active exploitation has been reported.

Successful exploitation of this vulnerability can lead to the execution of arbitrary JavaScript in the context of the victim's browser session. This may allow attackers to perform actions such as session hijacking, defacement, or other client-side attacks depending on the victim's privileges and context. However, exploitation requires the attacker to be authenticated, limiting the attack surface. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor vendor communications for updates. Until a patch is available, restricting authenticated user privileges and applying web application firewall rules to detect and block suspicious input patterns may help reduce risk.