CVE-2026-48228 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The issue arises because the id and ticket_id GET parameters in patient_w.php are not properly sanitized before being embedded into an HTML form action attribute. Authenticated attackers can exploit this by crafting a malicious URL that executes arbitrary JavaScript in the context of the victim's browser when the page is rendered. This can lead to typical XSS impacts such as session hijacking or unauthorized actions performed by the victim. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). There is no vendor advisory or patch information available, and the product is not a cloud service.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser via reflected XSS. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the victim's privileges. The impact is limited to users who are authenticated and interact with the vulnerable parameter. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit exposure by restricting access to trusted users only and applying web application firewall (WAF) rules to detect and block suspicious input in the id and ticket_id parameters. Monitor vendor channels for updates and apply patches promptly once released.