CVE-2026-48222 is a reflected XSS vulnerability in Open ISES Tickets prior to version 3.44.2. The issue arises because the frm_add_str POST parameter is directly embedded into a hidden input field in ics213.php without proper input neutralization. Authenticated attackers can exploit this by crafting a malicious request that injects JavaScript, which executes in the context of the victim's browser when the page is rendered. This vulnerability requires user interaction (UI:A) and does not require privileges (PR:N). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack or user interaction required beyond authentication, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser session within the affected application context. This can lead to session hijacking, unauthorized actions, or other client-side impacts typical of reflected XSS vulnerabilities. However, the attack requires the attacker to be authenticated and the victim to interact with a crafted request, limiting the scope and ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, organizations should monitor for vendor updates. In the meantime, restricting access to authenticated users and applying web application firewall (WAF) rules to detect and block suspicious input patterns targeting the frm_add_str parameter may help mitigate risk. Avoid exposing this parameter unnecessarily and educate users about phishing risks associated with malicious links.