CVE-2026-48222 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The issue exists in the ics213.php file where the frm_add_str POST parameter is directly embedded into a hidden input value attribute without proper neutralization or sanitization. Authenticated attackers can exploit this by sending a specially crafted request containing JavaScript payloads that execute in the context of the victim's browser upon rendering the response. This can lead to client-side script execution, potentially enabling session hijacking or other attacks dependent on script execution in the victim's context. The vulnerability is confirmed with a CVSS 4.0 score of 5.1, indicating medium severity. There is no explicit vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when viewing the affected page. This can lead to theft of session tokens, manipulation of web content, or other client-side attacks. The vulnerability requires authentication and user interaction (rendering the malicious response). There is no indication of privilege escalation or server-side compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.44.2, upgrading to version 3.44.2 or later may address the issue if the vendor has released a fix. Until an official fix is confirmed, avoid using affected versions or restrict access to the vulnerable functionality to trusted users only. Monitor vendor channels for updates and apply official patches once available.