CVE-2026-48225 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue arises because the _type POST parameter is passed unsanitized into a hidden input field within landb.php, enabling authenticated attackers to inject and execute arbitrary JavaScript in the context of a victim's browser session. This vulnerability requires user interaction and authentication but does not require elevated privileges. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser when the crafted request is rendered. This can lead to session hijacking, defacement, or other client-side attacks depending on the injected payload. However, the attack requires authentication and user interaction, limiting the overall impact severity to medium. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit access to trusted authenticated users and consider additional input validation or web application firewall rules to detect and block malicious payloads targeting the _type POST parameter. Monitor vendor channels for updates regarding an official patch.