CVE-2026-48224 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The vulnerability exists in the ics214.php file where the frm_add_str POST parameter is directly embedded into a hidden input value attribute without proper input neutralization. Authenticated attackers can exploit this by crafting a malicious request that injects JavaScript code, which executes in the context of the victim's browser when the page is rendered. This can lead to typical XSS impacts such as session hijacking or unauthorized actions performed on behalf of the victim. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction is needed, and limited scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, unauthorized actions, or other client-side impacts typical of reflected XSS vulnerabilities. The vulnerability requires user interaction and authentication, limiting its ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit access to trusted authenticated users and consider additional input validation or output encoding as a temporary mitigation. Monitor vendor channels for updates regarding an official patch or workaround.