CVE-2026-48227 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in patient.php where the id and ticket_id GET parameters are not properly neutralized before being embedded in an HTML form action attribute. Authenticated attackers can exploit this by crafting a URL containing malicious JavaScript payloads that execute in the context of the victim's browser upon rendering the response. This can lead to script execution but requires user interaction and authentication.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser session within the affected application context. This can lead to actions such as session hijacking, unauthorized actions on behalf of the user, or other client-side attacks. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1, indicating moderate impact without direct system compromise or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs containing id and ticket_id parameters. Because the vulnerability requires authentication and user interaction, limiting access to trusted users and educating them about suspicious links can reduce risk.