CVE-2026-48224 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the ics214.php script where the frm_add_str POST parameter is directly embedded into a hidden input field without proper neutralization. Authenticated attackers can exploit this by crafting a malicious request containing JavaScript payloads that execute in the context of the victim's browser when the response is rendered. This can lead to client-side script execution, potentially enabling session hijacking or other client-side attacks.

The vulnerability allows authenticated attackers to execute arbitrary JavaScript in the context of users viewing the affected page. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the victim. However, exploitation requires authentication, which limits the attack surface. No known exploits are reported in the wild at this time.

No official patch or remediation has been confirmed or published yet for this vulnerability. Users should monitor vendor advisories for updates regarding fixes. Until a patch is available, restricting access to trusted users and applying web application firewall rules to detect and block malicious input may help reduce risk.