CVE-2026-48223 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The vulnerability exists in the ics213rr.php file, where the frm_add_str POST parameter is directly embedded into an HTML form's hidden input value attribute without proper neutralization. This allows an authenticated attacker to inject and execute arbitrary JavaScript in the context of the victim's browser session. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact. The vulnerability is classified as medium severity with no current official fix or patch available.

Successful exploitation enables an authenticated attacker to execute arbitrary JavaScript code in the victim's browser, potentially leading to session hijacking, unauthorized actions, or other client-side impacts. The vulnerability requires user interaction and authentication, limiting its exploitation scope. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected functionality to trusted users only and monitor for suspicious activity related to the vulnerable parameter. Avoid using vulnerable versions in sensitive environments.