CVE-2026-48227 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The issue arises because the patient.php script improperly neutralizes input passed via the id and ticket_id GET parameters, embedding unsanitized values directly into an HTML form action attribute. This enables authenticated attackers to craft URLs containing malicious JavaScript payloads that execute in the context of the victim's browser when the page is rendered. The vulnerability requires user interaction and authentication but does not require elevated privileges. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other client-side attacks. However, the vulnerability does not directly impact server confidentiality, integrity, or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with URLs containing id and ticket_id parameters and avoid clicking on suspicious links. Implementing web application firewall (WAF) rules to detect and block suspicious input patterns may provide temporary mitigation. No vendor advisory or official patch is currently available.