CVE-2026-48223 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The vulnerability exists in the ics213rr.php file, where the frm_add_str POST parameter is directly embedded into an HTML hidden input field without proper neutralization. Authenticated attackers can exploit this by sending a specially crafted request containing JavaScript payloads that execute in the context of the victim's browser upon rendering the response. This can lead to script execution under the victim's session context.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, unauthorized actions, or other client-side attacks. The vulnerability does not require elevated privileges beyond authentication and has a medium severity rating (CVSS 5.1). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.44.2, upgrading to version 3.44.2 or later is recommended once a fix is available. Until then, restrict access to trusted users and monitor for suspicious activity related to the vulnerable parameter.